diff --git a/src/audit-logs/data/fpt/organization.json b/src/audit-logs/data/fpt/organization.json index 6688037011e3..864af99a4037 100644 --- a/src/audit-logs/data/fpt/organization.json +++ b/src/audit-logs/data/fpt/organization.json @@ -2,3211 +2,13140 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "@timestamp", + "operation_type", + "user_agent", + "_document_id", + "created_at", + "action", + "actor", + "actor_id", + "org_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "actor", + "operation_type", + "_document_id", + "user_agent", + "created_at", + "actor_id", + "@timestamp", + "user", + "action", + "user_id", + "programmatic_access_type" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "user_id", + "user", + "repo_id", + "repo", + "org", + "org_id", + "actions_cache_id", + "actions_cache_key", + "actions_cache_version", + "actions_cache_scope", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "advisory_credit.accept", "description": "Credit was accepted for a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", + "fields": [ + "user_agent", + "actor", + "actor_id", + "ghsa_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "advisory_credit.create", "description": "Someone was added to the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "ghsa_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "advisory_credit.decline", "description": "Credit was declined for a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "ghsa_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "advisory_credit.destroy", "description": "Someone was removed from the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "ghsa_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "actor", + "user_agent", + "actor_id", + "repo", + "repo_id", + "@timestamp", + "created_at", + "_document_id", + "operation_type", + "programmatic_access_type" + ] }, { "action": "auto_approve_personal_access_token_requests.disable", "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "auto_approve_personal_access_token_requests.enable", "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "actor_id", + "user", + "@timestamp", + "actor", + "user_id", + "action", + "created_at", + "operation_type", + "_document_id", + "user_agent" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "actor", + "operation_type", + "actor_id", + "org_id", + "@timestamp", + "user_agent", + "created_at", + "_document_id", + "org", + "email", + "action" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "oauth_application_id", + "@timestamp", + "actor_id", + "operation_type", + "_document_id", + "actor", + "user", + "user_id", + "user_agent", + "created_at", + "action" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user", + "operation_type", + "user_agent", + "created_at", + "user_id", + "actor", + "action", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "visibility", + "user_agent", + "user", + "@timestamp", + "repo", + "actor_id", + "user_id", + "action", + "created_at", + "actor", + "operation_type", + "repo_id", + "_document_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "actor", + "actor_id", + "operation_type", + "repo_id", + "action", + "created_at", + "_document_id", + "user_agent", + "repo", + "programmatic_access_type" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "origin_repository", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.attempted_to_create_from_prebuild", "description": "An attempt to create a codespace from a prebuild was made.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "owner", + "pull_request_id", + "user_id", + "user", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "codespaces.business_enablement_updated", "description": "Enterprise setting for Codespaces ownership was updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "enablement", + "organization_names", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "user_id", + "org_id", + "owner", + "name", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot", + "machine_type", + "devcontainer_path" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "owner", + "name", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot", + "machine_type", + "devcontainer_path" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "owner", + "name", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "owner", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "codespaces.policy_group_created", "description": "Policies were applied to codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.policy_group_deleted", "description": "Policies were removed from codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "codespaces.policy_group_updated", "description": "Policies were updated for codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.start_environment", "description": "A codespace was started.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "org", + "owner", + "pull_request_id", + "machine_type", + "user_id", + "user", + "devcontainer_path", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "user_agent", + "actor", + "actor_id", + "business", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "commit_comment.destroy", "description": "A commit comment was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "repo", + "org", + "org_id", + "created_at", + "@timestamp", + "operation_type", + "repo_id", + "actor_id", + "_document_id", + "user_agent", + "action", + "programmatic_access_type" + ] }, { "action": "commit_comment.update", "description": "A commit comment was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "repo_id", + "actor", + "org", + "action", + "@timestamp", + "repo", + "org_id", + "actor_id", + "created_at", + "user_agent", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "copilot.access_revoked", "description": "The user's Copilot access was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "reason", + "plan", + "org_id", + "owner", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.cfb_org_settings_changed", "description": "Settings for Copilot Business were changed at the organization level.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.cfb_seat_added", "description": "A seat was added to the Copilot Business subscription for a user and they have received access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "token_id", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_assignment_created", "description": "A seat assignment was newly created for a user.", - "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business" + "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", + "fields": [ + "actor", + "actor_id", + "user_agent", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.cfb_seat_assignment_refreshed", "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_assignment_reused", "description": "A seat assignment was re-created for a user who already had a seat with no pending cancellation date.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.cfb_seat_assignment_unassigned", "description": "A seat was unassigned from a user and they will lose access to GitHub Copilot at the end of the billing cycle.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_cancelled", "description": "A seat was canceled from the Copilot Business subscription and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "seat_assignment" + ] }, { "action": "copilot.cfb_seat_cancelled_by_staff", "description": "A seat was canceled from the Copilot Business subscription manually by GitHub and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user_id", + "user", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_management_changed", "description": "The seat management setting was changed for the Copilot Business subscription.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "old_value", + "new_value", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "copilot.content_exclusion_changed", "description": "The excluded paths for GitHub Copilot were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "excluded_paths", + "owner_type", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.knowledge_base_created", "description": "A knowledge base was created in the organization.", - "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases" + "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases", + "fields": [ + "actor", + "actor_id", + "user_agent", + "knowledge_base_name", + "org_id", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "copilot.knowledge_base_deleted", "description": "A knowledge base was deleted from the organization.", - "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases" + "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases", + "fields": [ + "actor", + "actor_id", + "user_agent", + "knowledge_base_name", + "org_id", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "copilot.knowledge_base_updated", "description": "A knowledge base was updated in the organization.", - "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases" + "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases", + "fields": [ + "actor", + "actor_id", + "user_agent", + "knowledge_base_name", + "org_id", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "custom_property_definition.create", "description": "A new custom property definition was created.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "property_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "value_type", + "required", + "default_value", + "definition_id" + ] }, { "action": "custom_property_definition.destroy", "description": "A custom property definition was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "property_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "value_type", + "required", + "default_value", + "definition_id", + "allowed_values" + ] }, { "action": "custom_property_definition.update", "description": "A custom property definition was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "property_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "value_type", + "required", + "default_value", + "old_allowed_values", + "allowed_values", + "definition_id", + "old_required", + "old_default_value", + "old_value_type", + "old_values_editable_by", + "values_editable_by" + ] }, { "action": "custom_property_value.create", "description": "A repository's custom property value was manually set for the first time.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "definition_id", + "property_name", + "value", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "custom_property_value.destroy", "description": "A repository's custom property value was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "custom_property_value.update", "description": "A repository's custom property value was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "definition_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "discussion_comment.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "org", + "repo_id", + "action", + "actor", + "org_id", + "_document_id", + "actor_id", + "operation_type", + "@timestamp", + "created_at", + "user_agent", + "programmatic_access_type" + ] }, { "action": "discussion_comment.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "@timestamp", + "actor", + "user_agent", + "org", + "_document_id", + "actor_id", + "operation_type", + "created_at", + "repo", + "org_id", + "action" + ] }, { "action": "discussion.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "user_agent", + "actor_id", + "org_id", + "actor", + "org", + "action", + "operation_type", + "@timestamp", + "title", + "_document_id", + "created_at", + "repo", + "programmatic_access_type" + ] }, { "action": "discussion_post.destroy", "description": "Triggered when a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "team", + "created_at", + "user_id", + "@timestamp", + "number", + "org", + "title", + "actor", + "actor_id", + "user", + "action", + "user_agent", + "operation_type", + "_document_id" + ] }, { "action": "discussion_post_reply.destroy", "description": "Triggered when a reply to a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "actor_id", + "action", + "@timestamp", + "user_agent", + "operation_type", + "user_id", + "actor", + "number", + "user", + "created_at", + "_document_id" + ] }, { "action": "discussion_post_reply.update", "description": "Triggered when a reply to a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "action", + "_document_id", + "org", + "@timestamp", + "actor_id", + "operation_type", + "user", + "user_id", + "org_id", + "user_agent", + "actor", + "number", + "team", + "created_at" + ] }, { "action": "discussion_post.update", "description": "Triggered when a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "created_at", + "_document_id", + "title", + "user", + "user_agent", + "org", + "operation_type", + "actor_id", + "@timestamp", + "actor", + "team", + "action", + "org_id", + "user_id", + "number" + ] }, { "action": "enterprise_installation.create", "description": "The GitHub App associated with a GitHub Connect connection was created.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "created_at", + "operation_type", + "@timestamp", + "_document_id", + "org_id", + "action", + "org", + "actor_id", + "user_agent", + "actor" + ] }, { "action": "enterprise_installation.destroy", "description": "The GitHub App associated with a GitHub Connect connection was deleted.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "created_at", + "_document_id", + "action", + "@timestamp", + "actor_id", + "actor", + "user_agent", + "org", + "operation_type", + "org_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "environment_name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "environment_name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "public_repo", + "token_scopes" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "environment_name", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "environment_name", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "git.clone", "description": "A repository was cloned.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "transport_protocol", + "repository", + "repository_public", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "user", + "user_id", + "transport_protocol_name" + ] }, { "action": "git.fetch", "description": "Changes were fetched from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "transport_protocol", + "repository", + "repository_public", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "user", + "user_id", + "transport_protocol_name" + ] }, { "action": "git.push", "description": "Changes were pushed to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "transport_protocol", + "repository", + "repository_public", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "user", + "user_id", + "transport_protocol_name" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "runner_group_id", + "business", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "business", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "runner_group_id", + "business", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "name", + "events", + "active", + "active_was", + "hook_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "name", + "org", + "user_agent", + "hook_id", + "repo", + "repo_id", + "created_at", + "oauth_application_id", + "action", + "events", + "org_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "oauth_application", + "_document_id", + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "repo_id", + "hook_id", + "events", + "repo", + "@timestamp", + "operation_type", + "name", + "action", + "created_at", + "org_id", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "events", + "repo", + "created_at", + "org", + "name", + "actor_id", + "repo_id", + "org_id", + "action", + "operation_type", + "oauth_application_id", + "user_agent", + "hook_id", + "@timestamp", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "events", + "repo", + "operation_type", + "action", + "_document_id", + "actor_id", + "name", + "events_were", + "@timestamp", + "created_at", + "hook_id", + "repo_id", + "org_id", + "org", + "user_agent", + "oauth_application_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "action", + "operation_type", + "@timestamp", + "actor", + "user_agent", + "actor_id", + "name", + "user_id", + "_document_id", + "integration", + "created_at", + "programmatic_access_type" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "user_id", + "actor_id", + "@timestamp", + "name", + "integration", + "user", + "_document_id", + "action", + "operation_type", + "created_at", + "user_agent" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "operation_type", + "@timestamp", + "name", + "repository_selection", + "user_id", + "action", + "user_agent", + "user", + "created_at", + "integration", + "_document_id", + "programmatic_access_type" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "actor", + "created_at", + "_document_id", + "repository_selection", + "integration", + "user_id", + "user", + "action", + "operation_type", + "name", + "actor_id", + "user_agent", + "programmatic_access_type" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "user_id", + "repository_selection", + "name", + "user", + "integration", + "operation_type", + "actor_id", + "action", + "repositories_added", + "created_at", + "_document_id", + "@timestamp", + "actor", + "user_agent", + "token_scopes", + "repositories_added_names", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "user", + "operation_type", + "user_agent", + "actor", + "repository_selection", + "repositories_removed", + "integration", + "user_id", + "created_at", + "_document_id", + "@timestamp", + "name", + "action", + "actor_id", + "repositories_removed_names", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "integration_installation_request.close", "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "url", + "actor", + "actor_id", + "created_at", + "operation_type", + "@timestamp", + "integration", + "action", + "user_agent", + "reason", + "_document_id", + "org", + "org_id" + ] }, { "action": "integration_installation_request.create", "description": "A member requested that an owner install a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "@timestamp", + "actor_id", + "org", + "_document_id", + "action", + "user_agent", + "created_at", + "url", + "org_id", + "operation_type", + "actor", + "integration" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "user_agent", + "name", + "repository_selection", + "actor_id", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "user_agent", + "name", + "repository_selection", + "actor_id", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "integration", + "user_id", + "user_agent", + "name", + "user", + "operation_type", + "actor_id", + "action", + "_document_id", + "created_at", + "repository_selection", + "@timestamp", + "actor" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "created_at", + "action", + "_document_id", + "name", + "org_id", + "manager", + "operation_type", + "actor", + "integration", + "org", + "@timestamp", + "actor_id", + "user_agent" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "user_agent", + "actor_id", + "org", + "operation_type", + "integration", + "org_id", + "_document_id", + "action", + "actor", + "name", + "created_at", + "manager", + "@timestamp" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation" + "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "integration", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "user_id", + "name", + "user", + "action", + "actor_id", + "created_at", + "_document_id", + "user_agent", + "operation_type", + "actor", + "integration" + ] }, { "action": "integration.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation" + "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "integration", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "ip_allow_list.disable", "description": "An IP allow list was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "actor", + "org", + "user_agent", + "_document_id", + "user_id", + "actor_id", + "created_at", + "org_id", + "action", + "@timestamp", + "user" + ] }, { "action": "ip_allow_list.disable_for_installed_apps", "description": "An IP allow list was disabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "ip_allow_list.enable", "description": "An IP allow list was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "business", + "user_id", + "actor", + "user", + "business_id", + "_document_id", + "action", + "@timestamp", + "user_agent", + "actor_id", + "operation_type", + "org", + "created_at" + ] }, { "action": "ip_allow_list.enable_for_installed_apps", "description": "An IP allow list was enabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "ip_allow_list_entry.create", "description": "An IP address was added to an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "active", + "org", + "ip_allow_list_entry", + "@timestamp", + "_document_id", + "operation_type", + "created_at", + "user_agent", + "action", + "actor_id", + "business_id", + "org_id", + "business", + "actor", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "ip_allow_list_entry.destroy", "description": "An IP address was deleted from an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "ip_allow_list_entry", + "org", + "operation_type", + "created_at", + "active", + "action", + "@timestamp", + "business", + "business_id", + "user_agent", + "org_id", + "actor", + "actor_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "ip_allow_list_entry.update", "description": "An IP address or its description was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "actor", + "org", + "action", + "operation_type", + "created_at", + "user_agent", + "actor_id", + "ip_allow_list_entry", + "active", + "org_id", + "@timestamp" + ] }, { "action": "issue_comment.destroy", "description": "A comment on an issue was deleted from the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "org", + "repo", + "actor_id", + "@timestamp", + "created_at", + "_document_id", + "action", + "operation_type", + "user_agent", + "repo_id", + "actor", + "oauth_application_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "org", + "action", + "repo_id", + "org_id", + "created_at", + "operation_type", + "@timestamp", + "user_agent", + "_document_id", + "actor_id", + "actor", + "oauth_application_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "issue.destroy", "description": "An issue was deleted from the repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue" + "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", + "fields": [ + "user", + "actor_id", + "created_at", + "title", + "@timestamp", + "_document_id", + "actor", + "user_id", + "action", + "operation_type", + "user_agent", + "repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "issue.pinned", "description": "An issue was pinned to a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "_document_id", + "user_agent", + "actor_id", + "created_at", + "action", + "actor", + "operation_type", + "owner_type", + "@timestamp", + "repo_id", + "number", + "repo", + "event", + "user", + "user_id" + ] }, { "action": "issue.transfer", "description": "An issue was transferred to another repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", + "fields": [ + "user", + "user_id", + "@timestamp", + "user_agent", + "owner_type", + "actor_id", + "number", + "repo", + "operation_type", + "_document_id", + "repo_id", + "action", + "created_at", + "actor", + "programmatic_access_type" + ] }, { "action": "issue.unpinned", "description": "An issue was unpinned from a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "event", + "user_agent", + "actor_id", + "repo_id", + "actor", + "action", + "created_at", + "repo", + "operation_type", + "_document_id", + "number", + "owner_type", + "@timestamp", + "user", + "user_id", + "token_scopes" + ] }, { "action": "issues.deletes_disabled", "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "user_agent", + "action", + "@timestamp", + "operation_type", + "actor_id", + "user_id", + "created_at", + "_document_id", + "actor", + "user", + "org", + "org_id" + ] }, { "action": "issues.deletes_enabled", "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "actor", + "@timestamp", + "created_at", + "user_agent", + "operation_type" + ] }, { "action": "issues.deletes_policy_cleared", "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "user", + "actor", + "business_id", + "action", + "operation_type", + "user_agent", + "created_at", + "@timestamp", + "_document_id", + "business", + "user_id", + "actor_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "@timestamp", + "_document_id", + "user_agent", + "operation_type", + "created_at", + "action", + "user", + "user_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "secondary_category", + "actor", + "primary_category", + "user", + "@timestamp", + "_document_id", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_id", + "marketplace_listing", + "integration", + "action" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "primary_category", + "user_agent", + "actor", + "marketplace_listing", + "@timestamp", + "integration", + "org_id", + "action", + "org", + "secondary_category", + "operation_type", + "created_at", + "actor_id", + "_document_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "primary_category", + "_document_id", + "user", + "created_at", + "user_agent", + "oauth_application", + "action", + "marketplace_listing", + "user_id", + "secondary_category", + "oauth_application_id", + "actor", + "actor_id", + "operation_type", + "@timestamp" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "actor", + "actor_id", + "user_agent", + "org_id", + "created_at", + "secondary_category", + "operation_type", + "marketplace_listing", + "action", + "@timestamp", + "_document_id", + "primary_category", + "integration" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "secondary_category", + "oauth_application_id", + "@timestamp", + "action", + "user_agent", + "user_id", + "operation_type", + "oauth_application", + "actor", + "created_at", + "marketplace_listing", + "actor_id", + "primary_category", + "user" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "primary_category", + "secondary_category", + "marketplace_listing", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "members_can_create_pages.disable", "description": "The ability for members to publish GitHub Pages sites was disabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "members_can_create_pages.enable", "description": "The ability for members to publish GitHub Pages sites was enabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "members_can_create_private_pages.disable", "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "members_can_create_private_pages.enable", "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "members_can_create_public_pages.disable", "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "members_can_create_public_pages.enable", "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "members_can_delete_repos.clear", "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "_document_id", + "user", + "user_id", + "business", + "operation_type", + "user_agent", + "actor", + "actor_id", + "business_id", + "@timestamp", + "created_at", + "action" + ] }, { "action": "members_can_delete_repos.disable", "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "org", + "_document_id", + "actor_id", + "user", + "user_id", + "user_agent", + "actor", + "operation_type", + "org_id", + "action", + "@timestamp", + "created_at" + ] }, { "action": "members_can_delete_repos.enable", "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "action", + "org_id", + "user_id", + "business", + "actor_id", + "@timestamp", + "_document_id", + "user", + "business_id", + "created_at", + "actor", + "org", + "operation_type", + "user_agent" + ] }, { "action": "members_can_view_dependency_insights.clear", "description": "An enterprise owner cleared the policy setting for viewing dependency insights in any organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "user", + "user_id", + "business", + "business_id", + "created_at", + "actor", + "action", + "operation_type" + ] }, { "action": "members_can_view_dependency_insights.disable", "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "business", + "created_at", + "user_id", + "business_id", + "user", + "org", + "operation_type", + "actor", + "_document_id", + "action", + "user_agent", + "actor_id", + "org_id", + "@timestamp" + ] }, { "action": "members_can_view_dependency_insights.enable", "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "created_at", + "_document_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "operation_type", + "@timestamp", + "action", + "actor", + "actor_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "max_entries_to_build", + "min_entries_to_merge", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "@timestamp", + "_document_id", + "user_id", + "action", + "operation_type", + "created_at" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "action", + "org", + "created_at", + "operation_type", + "org_id", + "@timestamp", + "_document_id", + "user_agent", + "actor" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "org_id", + "_document_id", + "org", + "repo_id", + "action", + "actor", + "created_at", + "operation_type", + "@timestamp", + "user_agent", + "actor_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "migration.destroy_file", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "@timestamp", + "org_id", + "action", + "operation_type", + "created_at", + "repo", + "_document_id", + "repo_id" + ] }, { "action": "migration.download", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "org_id", + "oauth_application_id", + "repo_id", + "operation_type", + "@timestamp", + "user_agent", + "created_at", + "org", + "action", + "_document_id", + "repo", + "actor", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "org", + "created_at", + "oauth_application_id", + "operation_type", + "user_agent", + "actor_id", + "org_id", + "action", + "actor", + "oauth_application", + "@timestamp", + "_document_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "created_at", + "oauth_application_id", + "user_id", + "operation_type", + "@timestamp", + "user_agent", + "oauth_application", + "_document_id", + "actor", + "actor_id", + "action", + "user" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user", + "user_id", + "action", + "oauth_application", + "operation_type", + "actor_id", + "_document_id", + "created_at", + "actor", + "oauth_application_id", + "@timestamp", + "user_agent" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "oauth_application_id", + "oauth_application", + "actor_id", + "user_agent", + "@timestamp", + "user_id", + "action", + "_document_id", + "actor", + "user", + "created_at", + "operation_type" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "actor", + "operation_type", + "created_at", + "user_agent", + "oauth_application", + "actor_id", + "oauth_application_id", + "@timestamp", + "user_id", + "_document_id", + "user", + "action" + ] }, { "action": "org.accept_business_invitation", "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.add_billing_manager", "description": "A billing manager was added to an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", + "fields": [ + "operation_type", + "_document_id", + "user_agent", + "org", + "user_id", + "action", + "created_at", + "org_id", + "user", + "actor", + "actor_id", + "@timestamp" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "permission", + "_document_id", + "org", + "operation_type", + "actor", + "user", + "@timestamp", + "created_at", + "user_agent", + "org_id", + "user_id", + "actor_id", + "action", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "inviter", + "org", + "org_id", + "repo", + "repo_id", + "public_repo", + "permission", + "invitee", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.add_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org_id", + "org", + "team", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "org.advanced_security_policy_selected_member_disabled", "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "org.advanced_security_policy_selected_member_enabled", "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "org.allow_third_party_access_requests_from_outside_collaborators_disabled", "description": "Third-party application access for outside collaborators was disabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled", "description": "Third-party application access for outside collaborators was enabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.archive", "description": "The organization was archived.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.audit_log_export", "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", + "fields": [ + "org_id", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "org", + "action", + "created_at", + "user_agent", + "actor_id" + ] }, { "action": "org.audit_log_git_event_export", "description": "An export of the organization's Git events was created.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "start", + "end", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "business", + "business_id" + ] }, { "action": "org.billing_signup_error", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "user_agent", + "action", + "@timestamp", + "actor_id", + "org_id", + "_document_id", + "actor", + "org", + "operation_type" + ] }, { "action": "org.block_user", "description": "An organization owner blocked a user from accessing the organization's repositories.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", + "fields": [ + "actor", + "user_agent", + "org_id", + "created_at", + "_document_id", + "blocked_user", + "action", + "operation_type", + "actor_id", + "org", + "@timestamp" + ] }, { "action": "org.cancel_business_invitation", "description": "An invitation for an organization to join an enterprise was revoked", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.cancel_invitation", "description": "An invitation sent to a user to join an organization was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "org_id", + "email", + "@timestamp", + "actor", + "action", + "operation_type", + "user_agent", + "org", + "_document_id", + "created_at", + "invitee_email", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "org.clear_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.codeql_enabled", "description": "Code scanning using the default setup was enabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.codespaces_access_updated", "description": "Access to use Codespaces on internal and private repositories was updated for an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "enablement", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.codespaces_ownership_updated", "description": "Ownership and payment for codespaces was updated for an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "owner_type", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.codespaces_team_access_allowed", "description": "A team has been allowed to use Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "team", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.codespaces_team_access_revoked", "description": "A team has been prevented from using Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "team", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.codespaces_user_access_allowed", "description": "A user has been allowed to use Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.codespaces_user_access_revoked", "description": "A user has been prevented from using Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.config.disable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "org", + "action", + "operation_type", + "_document_id", + "actor", + "actor_id", + "@timestamp", + "user_agent", + "org_id", + "created_at" + ] }, { "action": "org.config.disable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "operation_type", + "@timestamp", + "created_at", + "user_agent", + "action", + "actor_id", + "org", + "_document_id", + "actor", + "org_id" + ] }, { "action": "org.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "_document_id", + "operation_type", + "actor_id", + "org_id", + "action", + "created_at", + "actor", + "org", + "@timestamp", + "user_agent" + ] }, { "action": "org.config.enable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "created_at", + "_document_id", + "actor_id", + "actor", + "org", + "org_id", + "operation_type", + "action", + "user_agent" + ] }, { "action": "org.config.enable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "actor", + "actor_id", + "org_id", + "action", + "operation_type", + "@timestamp", + "user_agent", + "org", + "created_at", + "_document_id" + ] }, { "action": "org.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "actor_id", + "action", + "created_at", + "user_agent", + "actor", + "_document_id", + "org_id", + "operation_type", + "org", + "@timestamp" + ] }, { "action": "org.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.confirm_business_invitation", "description": "An invitation for an organization to join an enterprise was confirmed.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.connect_usage_metrics_export", "description": "Server statistics were exported for the organization.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.create", "description": "An organization was created.", - "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" + "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", + "fields": [ + "org", + "actor_id", + "actor", + "action", + "@timestamp", + "_document_id", + "user_agent", + "operation_type", + "org_id", + "created_at" + ] }, { "action": "org.create_actions_secret", "description": "A GitHub Actions secret was created for an organization.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.create_integration_secret", "description": "An integration secret was created for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "visibility", + "integration", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "org_credential_authorization.deauthorize", "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", + "fields": [ + "user_agent", + "operation_type", + "created_at", + "actor_id", + "org_id", + "business", + "action", + "@timestamp", + "org", + "_document_id", + "business_id", + "actor", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "org_credential_authorization.grant", "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", + "fields": [ + "user_agent", + "actor", + "@timestamp", + "created_at", + "org_id", + "business_id", + "operation_type", + "_document_id", + "action", + "actor_id", + "business", + "org", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "org_credential_authorization.revoke", "description": "An owner revoked authorized credentials.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", + "fields": [ + "actor", + "org", + "@timestamp", + "owner", + "oauth_application_id", + "org_id", + "operation_type", + "action", + "business", + "created_at", + "business_id", + "actor_id", + "_document_id", + "user_agent" + ] }, { "action": "org.disable_member_team_creation_permission", "description": "Team creation was limited to owners.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "actor", + "@timestamp", + "_document_id", + "user", + "user_id", + "action", + "created_at", + "actor_id", + "user_agent", + "org", + "org_id", + "operation_type" + ] }, { "action": "org.disable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were disabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "actor_id", + "org_id", + "action", + "_document_id", + "@timestamp", + "actor", + "org", + "operation_type", + "user_agent", + "created_at" + ] }, { "action": "org.disable_reader_discussion_creation_permission", "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.disable_saml", "description": "SAML single sign-on was disabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "sso_url", + "issuer", + "action", + "@timestamp", + "_document_id", + "created_at", + "org", + "operation_type" + ] }, { "action": "org.disable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the organization was disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.disable_two_factor_requirement", "description": "A two-factor authentication requirement was disabled for the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "org", + "org_id", + "action", + "actor", + "actor_id", + "operation_type", + "@timestamp", + "_document_id", + "user_agent" + ] }, { "action": "org.display_commenter_full_name_disabled", "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "user_id", + "user", + "action", + "operation_type", + "@timestamp", + "_document_id", + "created_at", + "user_agent", + "org", + "actor_id", + "org_id" + ] }, { "action": "org.display_commenter_full_name_enabled", "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "user_agent", + "actor", + "_document_id", + "user_id", + "operation_type", + "@timestamp", + "created_at", + "user", + "action", + "actor_id", + "org_id" + ] }, { "action": "org.enable_member_team_creation_permission", "description": "Team creation by members was allowed.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "org_id", + "user", + "actor", + "operation_type", + "_document_id", + "user_id", + "created_at", + "user_agent", + "actor_id", + "org", + "action", + "@timestamp" + ] }, { "action": "org.enable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were enabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "actor_id", + "operation_type", + "org", + "created_at", + "_document_id", + "actor", + "org_id", + "action", + "user_agent", + "@timestamp" + ] }, { "action": "org.enable_reader_discussion_creation_permission", "description": "An organization owner allowed users with read access to create discussions in an organization", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "org", + "org_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "org.enable_saml", "description": "SAML single sign-on was enabled for the organization.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", + "fields": [ + "actor_id", + "action", + "operation_type", + "actor", + "sso_url", + "org", + "created_at", + "@timestamp", + "issuer", + "org_id", + "_document_id", + "user_agent" + ] }, { "action": "org.enable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the organization was enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.enable_two_factor_requirement", "description": "Two-factor authentication is now required for the organization.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "actor_id", + "action", + "_document_id", + "org", + "@timestamp", + "actor", + "user_agent", + "org_id", + "operation_type", + "created_at" + ] }, { "action": "org.integration_manager_added", "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "org_id", + "manager", + "@timestamp", + "actor", + "operation_type", + "_document_id", + "actor_id", + "org", + "action", + "created_at" + ] }, { "action": "org.integration_manager_removed", "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "@timestamp", + "org", + "user_agent", + "action", + "actor", + "actor_id", + "manager", + "operation_type", + "created_at", + "_document_id" + ] }, { "action": "org.invite_member", "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", + "fields": [ + "org", + "user_id", + "org_id", + "user", + "action", + "operation_type", + "_document_id", + "actor", + "@timestamp", + "created_at", + "user_agent", + "actor_id", + "invitee_email", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "org.invite_to_business", "description": "An organization was invited to join an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "org_id", + "user_agent", + "actor_id", + "user_id", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "actor", + "user", + "action" + ] }, { "action": "org.oauth_app_access_approved", "description": "Access to an organization was granted for an OAuth App.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", + "fields": [ + "url", + "actor", + "user_agent", + "actor_id", + "operation_type", + "org_id", + "_document_id", + "org", + "action", + "created_at", + "@timestamp" + ] }, { "action": "org.oauth_app_access_blocked", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "url", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.oauth_app_access_denied", "description": "Access was disabled for an OAuth App that was previously approved.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", + "fields": [ + "url", + "created_at", + "org_id", + "action", + "@timestamp", + "_document_id", + "user_agent", + "org", + "operation_type", + "actor", + "actor_id" + ] }, { "action": "org.oauth_app_access_requested", "description": "An organization member requested that an owner grant an OAuth App access to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "operation_type", + "created_at", + "user_agent", + "actor_id", + "_document_id", + "url", + "org_id", + "action", + "@timestamp", + "org" + ] }, { "action": "org.oauth_app_access_unblocked", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "url", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.rate_limited_invites", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "created_at", + "org_id", + "action", + "actor", + "actor_id", + "user_agent", + "operation_type", + "_document_id", + "org" + ] }, { "action": "org.recovery_code_failed", "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", + "fields": [ + "actor", + "actor_id", + "user_agent", + "reason", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.recovery_code_used", "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.recovery_codes_downloaded", "description": "An organization owner downloaded the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.recovery_codes_generated", "description": "An organization owner generated the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.recovery_codes_printed", "description": "An organization owner printed the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.recovery_codes_viewed", "description": "An organization owner viewed the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", + "fields": [ + "actor", + "operation_type", + "@timestamp", + "_document_id", + "org", + "org_id", + "action", + "created_at", + "user_agent", + "actor_id", + "actor_is_bot" + ] }, { "action": "org.remove_actions_secret", "description": "A GitHub Actions secret was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.remove_billing_manager", "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "user_id", + "user_agent", + "org_id", + "user", + "action", + "_document_id", + "operation_type", + "@timestamp", + "actor", + "org", + "actor_id", + "created_at" + ] }, { "action": "org.remove_integration_secret", "description": "An integration secret was removed from an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "integration", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "actor_id", + "user_agent", + "actor", + "action", + "user_id", + "@timestamp", + "created_at", + "user", + "operation_type", + "org_id", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "org.remove_outside_collaborator", "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "user", + "org_id", + "created_at", + "@timestamp", + "action", + "operation_type", + "user_agent", + "_document_id", + "actor", + "actor_id", + "user_id", + "programmatic_access_type" + ] }, { "action": "org.remove_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org_id", + "org", + "team", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", + "fields": [ + "operation_type", + "org_id", + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "org", + "created_at", + "actor", + "action", + "programmatic_access_type" + ] }, { "action": "org.rename", "description": "An organization was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "_document_id", + "@timestamp", + "org", + "action", + "actor", + "old_login", + "org_id", + "actor_id", + "operation_type", + "created_at" + ] }, { "action": "org.required_workflow_create", "description": "Triggered when a required workflow is created.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.required_workflow_delete", "description": "Triggered when a required workflow is deleted.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.required_workflow_update", "description": "Triggered when a required workflow is updated.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.restore_member", "description": "An organization member was restored.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", + "fields": [ + "user", + "actor", + "user_id", + "_document_id", + "action", + "created_at", + "org_id", + "operation_type", + "@timestamp", + "user_agent", + "org", + "actor_id" + ] }, { "action": "org.revoke_external_identity", "description": "A member's linked identity was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", + "fields": [ + "actor", + "org", + "org_id", + "user", + "operation_type", + "user_id", + "@timestamp", + "action", + "actor_id", + "user_agent", + "_document_id", + "created_at" + ] }, { "action": "org.revoke_sso_session", "description": "A member's SAML session was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", + "fields": [ + "actor_id", + "created_at", + "user", + "action", + "operation_type", + "@timestamp", + "org", + "org_id", + "user_agent", + "actor", + "user_id", + "_document_id" + ] }, { "action": "org.runner_group_created", "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "programmatic_access_type" + ] }, { "action": "org.runner_group_removed", "description": "A self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.runner_group_renamed", "description": "A self-hosted runner group was renamed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "org.runner_group_runner_removed", "description": "The REST API was used to remove a self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "runner_group_id", + "runner_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "org.runner_group_runners_added", "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "org.runner_group_runners_updated", "description": "A runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "runner_group_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.runner_group_updated", "description": "The configuration of a self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "runner_group_name", + "runner_group_allow_public", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "programmatic_access_type" + ] }, { "action": "org.runner_group_visiblity_updated", "description": "The visibility of a self-hosted runner group was updated via the REST API.", - "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "visibility", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "org_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org_secret_scanning_generic_secrets.disabled", "description": "Generic secrets have been disabled at the organization level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org_secret_scanning_generic_secrets.enabled", "description": "Generic secrets have been enabled at the organization level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_disabled", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_enabled", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_updated", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.secret_scanning_push_protection_disable", "description": "Push protection for secret scanning was disabled.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.secret_scanning_push_protection_enable", "description": "Push protection for secret scanning was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_disable", "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_enable", "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "org_id", + "org", + "runner_id", + "runner_name", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp" + ] }, { "action": "org.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "org_id", + "org", + "runner_id", + "runner_name", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp" + ] }, { "action": "org.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "org_id", + "runner_id", + "runner_name", + "source_version", + "target_version", + "runner_group_id", + "runner_group_name" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "policy", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "actor", + "actor_id", + "user_agent", + "policy", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "limit", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.set_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "_document_id", + "org_id", + "operation_type", + "actor", + "actor_id", + "@timestamp", + "created_at", + "org", + "action" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "policy", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "user_agent", + "actor", + "actor_id", + "org_id", + "@timestamp", + "org", + "issuer", + "business", + "operation_type", + "created_at", + "business_id", + "_document_id", + "actor_is_bot" + ] }, { "action": "org.transfer", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "actor", + "actor_id", + "user_agent", + "from_business", + "to_business", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.transfer_outgoing", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "business", + "business_id", + "from_business", + "to_business", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.unarchive", "description": "The organization was unarchived.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.unblock_user", "description": "A user was unblocked from an organization.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", + "fields": [ + "oauth_application_id", + "_document_id", + "blocked_user", + "action", + "operation_type", + "@timestamp", + "created_at", + "actor", + "actor_id", + "org", + "org_id", + "user_agent" + ] }, { "action": "org.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "created_at", + "key", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.update_actions_settings", "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "new_policy", + "updated_allowed_types", + "old_policy", + "updated_access_policy", + "programmatic_access_type" + ] }, { "action": "org.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.update_default_repository_permission", "description": "The default repository permission level for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "action", + "operation_type", + "created_at", + "org", + "org_id", + "@timestamp", + "user_agent", + "permission", + "actor_id", + "old_permission", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.update_integration_secret", "description": "An integration secret was updated for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "visibility", + "integration", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "org_id", + "created_at", + "_document_id", + "user", + "user_id", + "action", + "actor_id", + "old_permission", + "permission", + "actor", + "user_agent", + "operation_type", + "org" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "action", + "@timestamp", + "actor_id", + "permission", + "created_at", + "user_agent", + "org", + "org_id", + "_document_id", + "visibility", + "operation_type" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "actor_id", + "permission", + "action", + "org_id", + "actor", + "created_at", + "_document_id", + "business_id", + "operation_type", + "org", + "user_agent", + "business", + "@timestamp" + ] }, { "action": "org.update_new_repository_default_branch_setting", "description": "The name of the default branch was changed for new repositories in the organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.update_repo_self_hosted_runners_policy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "old_repo_runners_policy", + "new_repo_runners_policy", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.update_saml_provider_settings", "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "sso_url", + "actor_id", + "operation_type", + "@timestamp", + "issuer", + "org", + "_document_id", + "actor", + "org_id", + "created_at", + "action" + ] }, { "action": "org.update_terms_of_service", "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", - "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" + "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", + "fields": [ + "org_id", + "actor", + "actor_id", + "user_agent", + "operation_type", + "_document_id", + "org", + "action", + "@timestamp", + "created_at" + ] }, { "action": "organization_default_label.create", "description": "A default label was created for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", + "fields": [ + "actor_id", + "actor", + "org", + "org_id", + "operation_type", + "_document_id", + "action", + "created_at", + "@timestamp", + "user_agent" + ] }, { "action": "organization_default_label.destroy", "description": "A default label was deleted for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", + "fields": [ + "operation_type", + "actor", + "@timestamp", + "_document_id", + "actor_id", + "org_id", + "org", + "action", + "created_at", + "user_agent" + ] }, { "action": "organization_default_label.update", "description": "A default label was edited for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", + "fields": [ + "org", + "created_at", + "@timestamp", + "actor", + "action", + "user_agent", + "actor_id", + "org_id", + "operation_type", + "_document_id" + ] }, { "action": "organization_domain.approve", "description": "A domain was approved for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner_type", + "org_id", + "business_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "organization_domain.create", "description": "A domain was added to an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "created_at", + "_document_id", + "action", + "actor_id", + "operation_type", + "@timestamp", + "user_agent", + "actor" + ] }, { "action": "organization_domain.destroy", "description": "A domain was removed from an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", + "fields": [ + "action", + "@timestamp", + "_document_id", + "user_agent", + "actor", + "actor_id", + "operation_type", + "created_at" + ] }, { "action": "organization_domain.verify", "description": "A domain was verified for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "operation_type", + "@timestamp", + "user_agent", + "actor", + "action", + "created_at", + "_document_id", + "actor_id" + ] }, { "action": "organization_moderators.add_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "team", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "organization_moderators.add_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "organization_moderators.remove_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "team", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "organization_moderators.remove_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "programmatic_access_type" + ] }, { "action": "organization_projects_change.clear", "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "actor", + "business_id", + "@timestamp", + "actor_id", + "user", + "user_id", + "action", + "user_agent", + "_document_id", + "created_at", + "operation_type", + "business" + ] }, { "action": "organization_projects_change.disable", "description": "Organization projects were disabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "org_id", + "action", + "user", + "org", + "created_at", + "user_agent", + "actor_id", + "operation_type", + "@timestamp", + "actor", + "user_id", + "_document_id" + ] }, { "action": "organization_projects_change.enable", "description": "Organization projects were enabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "actor_id", + "org_id", + "created_at", + "user_id", + "org", + "@timestamp", + "_document_id", + "user_agent", + "actor", + "user", + "action", + "operation_type" + ] }, { "action": "organization_role.assign", "description": "An organization role was assigned to a user or team.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "actor", + "actor_id", + "user_agent", + "organization_role_id", + "organization_role_name", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "organization_role.create", "description": "A custom organization role was created in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "name", + "owner", + "role_permissions", + "base_role", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "organization_role.destroy", "description": "A custom organization role was deleted in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "name", + "owner", + "role_permissions", + "base_role", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "organization_role.revoke", "description": "A user or team was unassigned an organization role.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "actor", + "actor_id", + "user_agent", + "organization_role_id", + "organization_role_name", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "organization_role.update", "description": "A custom organization role was edited in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "name", + "owner", + "role_permissions", + "base_role", + "old_role_permissions", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "packages.package_deleted", "description": "An entire package was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "actor_id", + "actor", + "org", + "org_id", + "repo", + "repo_id", + "package", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "packages.package_published", "description": "A package was published or republished to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "actor", + "org", + "org_id", + "repo", + "repo_id", + "package", + "ecosystem", + "version_count", + "is_republished", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "packages.package_version_deleted", "description": "A specific package version was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "actor_id", + "actor", + "org", + "org_id", + "repo", + "repo_id", + "package", + "version", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "ecosystem", + "actor_is_bot" + ] }, { "action": "packages.package_version_published", "description": "A specific package version was published or republished to a package.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "ecosystem", + "package", + "version", + "actor_id", + "user_agent", + "is_republished", + "actor", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "owner_type", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "owner_type", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "owner_type", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "user", + "operation_type", + "user_id", + "_document_id", + "action", + "actor", + "actor_id", + "@timestamp", + "created_at" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "created_at", + "actor_id", + "@timestamp", + "user_id", + "action", + "operation_type", + "actor", + "_document_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "org_id", + "created_at", + "actor_id", + "@timestamp", + "action", + "actor", + "org", + "user_agent", + "_document_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "repository_selection", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "repository_selection", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "org", + "org_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "user", + "user_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user_programmatic_access_name", + "org", + "org_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "prebuild_configuration.create", "description": "A GitHub Codespaces prebuild configuration for a repository was created.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "user_agent", + "actor", + "actor_id", + "branch", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "prebuild_configuration.destroy", "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "user_agent", + "actor", + "actor_id", + "branch", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "prebuild_configuration.run_triggered", "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "user_agent", + "actor", + "actor_id", + "branch", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "prebuild_configuration.update", "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "user_agent", + "actor", + "actor_id", + "branch", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_repository_forking.clear", "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "user_id", + "action", + "operation_type", + "@timestamp", + "business_id", + "actor_id", + "user", + "business", + "actor", + "created_at", + "_document_id" + ] }, { "action": "private_repository_forking.disable", "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "created_at", + "actor_id", + "_document_id", + "actor", + "user", + "repo", + "action", + "user_agent", + "@timestamp", + "org", + "operation_type", + "user_id", + "org_id", + "programmatic_access_type" + ] }, { "action": "private_repository_forking.enable", "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user_id", + "operation_type", + "_document_id", + "action", + "@timestamp", + "repo", + "org", + "business", + "user_agent", + "actor", + "repo_id", + "user", + "org_id", + "created_at", + "business_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "user", + "actor_id", + "user_id", + "@timestamp", + "created_at", + "owner", + "action", + "_document_id", + "user_agent", + "actor", + "operation_type" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "actor", + "user_agent", + "operation_type", + "user", + "created_at", + "user_id", + "action", + "_document_id", + "@timestamp" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "org_id", + "user_agent", + "operation_type", + "@timestamp", + "created_at", + "repo_id", + "org", + "_document_id", + "action", + "actor", + "actor_id", + "repo" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user", + "_document_id", + "user_id", + "user_agent", + "@timestamp", + "actor_id", + "action", + "created_at", + "actor" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "actor_id", + "operation_type", + "actor", + "user_id", + "@timestamp", + "created_at", + "_document_id", + "user_agent", + "user" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "action", + "actor_id", + "org_id", + "user_agent", + "actor", + "operation_type", + "@timestamp", + "_document_id", + "created_at", + "org", + "repo" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "actor", + "actor_id", + "action", + "user_id", + "_document_id", + "user_agent", + "operation_type", + "user", + "@timestamp", + "created_at" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "created_at", + "actor_id", + "old_name", + "operation_type", + "@timestamp", + "repo", + "_document_id", + "user_agent", + "org_id", + "business_id", + "actor", + "repo_id", + "org", + "business" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "repo_id", + "operation_type", + "actor", + "action", + "created_at", + "actor_id", + "_document_id", + "@timestamp", + "user_agent", + "org", + "org_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "org", + "@timestamp", + "_document_id", + "operation_type", + "created_at", + "actor_id", + "action", + "org_id", + "user_agent" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "org_id", + "operation_type", + "org", + "actor_id", + "_document_id", + "team", + "@timestamp", + "action", + "user_agent", + "actor" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "operation_type", + "@timestamp", + "actor_id", + "user", + "user_agent", + "actor", + "created_at", + "org", + "_document_id", + "org_id", + "action", + "programmatic_access_type" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "protected_branch.authorized_users_teams", "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", + "fields": [ + "repo", + "action", + "org_id", + "user_agent", + "name", + "created_at", + "_document_id", + "operation_type", + "actor", + "repo_id", + "org", + "actor_id", + "oauth_application_id", + "@timestamp", + "programmatic_access_type" + ] }, { "action": "protected_branch.branch_allowances", "description": "A protected branch allowance was given to a specific user, team or integration.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "token_id", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "name", + "authorized_actors", + "policy", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "protected_branch.create", "description": "Branch protection was enabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "repo_id", + "user_id", + "@timestamp", + "user_agent", + "repo", + "name", + "org_id", + "user", + "_document_id", + "actor", + "actor_id", + "org", + "action", + "created_at", + "authorized_actor_names", + "token_scopes", + "required_deployments_enforcement_level", + "merge_queue_enforcement_level", + "create_protected" + ] }, { "action": "protected_branch.destroy", "description": "Branch protection was disabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "name", + "repo", + "@timestamp", + "actor", + "org", + "actor_id", + "repo_id", + "org_id", + "operation_type", + "action", + "user_agent", + "created_at", + "_document_id", + "token_scopes", + "required_deployments_enforcement_level", + "merge_queue_enforcement_level", + "create_protected" + ] }, { "action": "protected_branch.dismiss_stale_reviews", "description": "Enforcement of dismissing stale pull requests was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "dismiss_stale_reviews_on_push", + "org_id", + "action", + "created_at", + "_document_id", + "@timestamp", + "actor_id", + "repo_id", + "operation_type", + "actor", + "repo", + "org", + "name", + "programmatic_access_type" + ] }, { "action": "protected_branch.dismissal_restricted_users_teams", "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "repo_id", + "actor", + "oauth_application_id", + "authorized_actors_only", + "authorized_actors", + "created_at", + "user_agent", + "name", + "_document_id", + "org_id", + "@timestamp", + "actor_id", + "org", + "action", + "operation_type", + "programmatic_access_type" + ] }, { "action": "protected_branch.policy_override", "description": "A branch protection requirement was overridden by a repository administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "created_at", + "actor", + "reasons", + "@timestamp", + "before", + "after", + "actor_id", + "repo", + "operation_type", + "user_agent", + "branch", + "overridden_codes", + "org", + "org_id", + "action", + "_document_id", + "referrer", + "business", + "business_id", + "deploy_key_fingerprint", + "token_scopes", + "programmatic_access_type", + "compliant_pull_request_ids" + ] }, { "action": "protected_branch.rejected_ref_update", "description": "A branch update attempt was rejected.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "org", + "@timestamp", + "created_at", + "_document_id", + "business", + "org_id", + "operation_type", + "repo_id", + "actor", + "branch", + "action", + "actor_id", + "business_id", + "deploy_key_fingerprint", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "protected_branch.update_admin_enforced", "description": "Branch protection was enforced for repository administrators.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "admin_enforced", + "operation_type", + "user_agent", + "actor", + "org", + "name", + "repo", + "@timestamp", + "action", + "repo_id", + "org_id", + "_document_id", + "created_at", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_allow_deletions_enforcement_level", "description": "Branch deletion was enabled or disabled for a protected branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "name", + "operation_type", + "repo", + "@timestamp", + "org_id", + "org", + "action", + "allow_deletions_enforcement_level", + "_document_id", + "created_at", + "actor_id", + "user_agent", + "actor", + "repo_id" + ] }, { "action": "protected_branch.update_allow_force_pushes_enforcement_level", "description": "Force pushes were enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "actor_id", + "name", + "_document_id", + "actor", + "repo", + "operation_type", + "allow_force_pushes_enforcement_level", + "@timestamp", + "org", + "action", + "created_at", + "user_agent", + "repo_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_ignore_approvals_from_contributors", "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "ignore_approvals_from_contributors", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "protected_branch.update_linear_history_requirement_enforcement_level", "description": "Required linear commit history was enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "action", + "user_agent", + "operation_type", + "actor", + "linear_history_requirement_enforcement_level", + "repo", + "name", + "org_id", + "repo_id", + "org", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_lock_allows_fetch_and_merge", "description": "Fork syncing was enabled or disabled for a read-only branch", - "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "lock_allows_fetch_and_merge", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_lock_branch_enforcement_level", "description": "The enforcement of a branch lock was updated.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "enforcement_level", + "lock_branch_enforcement_level", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "merge_queue_enforcement_level", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "protected_branch.update_name", "description": "A branch name pattern was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "old_name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_pull_request_reviews_enforcement_level", "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "name", + "org_id", + "_document_id", + "actor_id", + "@timestamp", + "business_id", + "pull_request_reviews_enforcement_level", + "org", + "repo", + "action", + "business", + "user_agent", + "created_at", + "repo_id", + "operation_type", + "actor", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_require_code_owner_review", "description": "Enforcement of required code owner review was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "created_at", + "require_code_owner_review", + "operation_type", + "name", + "user_agent", + "action", + "@timestamp", + "actor", + "actor_id", + "repo", + "org", + "repo_id", + "_document_id", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_require_last_push_approval", "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "require_last_push_approval", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_required_approving_review_count", "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "required_approving_review_count", + "repo", + "repo_id", + "created_at", + "actor", + "operation_type", + "user_agent", + "name", + "org_id", + "action", + "actor_id", + "_document_id", + "org", + "@timestamp", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_required_status_checks_enforcement_level", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "org_id", + "user_agent", + "@timestamp", + "_document_id", + "name", + "repo", + "action", + "business_id", + "repo_id", + "business", + "actor_id", + "operation_type", + "created_at", + "required_status_checks_enforcement_level", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_signature_requirement_enforcement_level", "description": "Enforcement of required commit signing was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "name", + "@timestamp", + "created_at", + "_document_id", + "repo_id", + "org", + "org_id", + "action", + "actor", + "actor_id", + "signature_requirement_enforcement_level", + "repo", + "user_agent", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_strict_required_status_checks_policy", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "_document_id", + "org", + "@timestamp", + "created_at", + "repo_id", + "org_id", + "user_agent", + "name", + "actor", + "repo", + "operation_type", + "action", + "strict_required_status_checks_policy", + "programmatic_access_type" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "read_only", + "user_agent", + "actor_id", + "operation_type", + "created_at", + "_document_id", + "key", + "fingerprint", + "actor", + "action", + "user", + "user_id", + "@timestamp", + "title", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "fingerprint", + "user_agent", + "read_only", + "explanation", + "repo", + "@timestamp", + "action", + "key", + "operation_type", + "_document_id", + "actor", + "title", + "actor_id", + "repo_id", + "created_at", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "user_agent", + "title", + "key", + "fingerprint", + "read_only", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "created_at", + "operation_type", + "_document_id", + "title", + "key", + "action", + "actor", + "read_only", + "explanation", + "repo_id", + "@timestamp", + "actor_id", + "repo", + "user_agent", + "fingerprint" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "actor", + "user_agent", + "key", + "fingerprint", + "read_only", + "repo_id", + "operation_type", + "created_at", + "actor_id", + "repo", + "action", + "_document_id", + "title", + "@timestamp", + "programmatic_access_type" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "repo_id", + "actor", + "key", + "fingerprint", + "@timestamp", + "actor_id", + "oauth_application_id", + "title", + "action", + "user_agent", + "created_at", + "repo", + "read_only", + "operation_type", + "_document_id", + "user", + "user_id", + "programmatic_access_type" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "operation_type", + "user", + "@timestamp", + "_document_id", + "action", + "created_at", + "key", + "fingerprint", + "actor_id", + "actor", + "title", + "user_agent", + "user_id", + "read_only", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request.close", "description": "A pull request was closed without being merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "pull_request.converted_to_draft", "description": "A pull request was converted to a draft.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request.create", "description": "A pull request was created.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "pull_request.create_review_request", "description": "A review was requested on a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "pull_request.in_progress", "description": "A pull request was marked as in progress.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "pull_request.indirect_merge", "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "pull_request.merge", "description": "A pull request was merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "pull_request.ready_for_review", "description": "A pull request was marked as ready for review.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request.rebase", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "pull_request_url", + "pull_request_title", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "programmatic_access_type" + ] }, { "action": "pull_request.remove_review_request", "description": "A review request was removed from a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "pull_request.reopen", "description": "A pull request was reopened after previously being closed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "pull_request_review_comment.create", "description": "A review comment was added to a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request_review_comment.delete", "description": "A review comment on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "@timestamp", + "_document_id", + "repo", + "created_at", + "actor_id", + "repo_id", + "action", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request_review_comment.update", "description": "A review comment on a pull request was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user_agent", + "actor_id", + "action", + "created_at", + "actor", + "_document_id", + "@timestamp", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request_review.delete", "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request_review.dismiss", "description": "A review on a pull request was dismissed.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "pull_request_review.submit", "description": "A review on a pull request was submitted.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "repo_id", + "user", + "operation_type", + "@timestamp", + "actor_id", + "user_id", + "created_at", + "user_agent", + "actor", + "action", + "repo", + "visibility", + "_document_id", + "previous_visibility", + "programmatic_access_type" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "visibility", + "repo", + "created_at", + "user_agent", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "actor_id", + "repo_id", + "user", + "action", + "user_id", + "oauth_application_id", + "org", + "org_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "action", + "user_agent", + "actor", + "repo", + "repo_id", + "user", + "org", + "org_id", + "actor_id", + "topic", + "@timestamp", + "_document_id", + "user_id", + "created_at", + "operation_type", + "programmatic_access_type" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "repo_id", + "user_agent", + "user_id", + "created_at", + "@timestamp", + "repo", + "user", + "operation_type", + "visibility", + "action", + "actor_id", + "actor", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "oauth_application_id", + "user_agent", + "created_at", + "@timestamp", + "_document_id", + "actor_id", + "operation_type", + "action", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "tool", + "category" + ] + }, + { + "action": "repo.code_scanning_autofix_disabled", + "description": "Autofix for code scanning alerts was disabled for a repository.", + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] + }, + { + "action": "repo.code_scanning_autofix_enabled", + "description": "Autofix for code scanning alerts was enabled for a repository.", + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "actor", + "actor_id", + "user_agent", + "tool", + "branch", + "category", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.codeql_disabled", "description": "Code scanning using the default setup was disabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.codeql_enabled", "description": "Code scanning using the default setup was enabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to this repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "repo.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to this repository was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo_id", + "_document_id", + "action", + "created_at", + "repo", + "operation_type", + "@timestamp" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "repo", + "@timestamp", + "actor", + "_document_id", + "user_agent", + "actor_id", + "repo_id", + "action", + "operation_type", + "created_at" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "actor", + "repo_id", + "action", + "user_agent", + "_document_id", + "@timestamp", + "created_at", + "actor_id", + "repo", + "operation_type" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "actor", + "oauth_application_id", + "created_at", + "action", + "repo_id", + "repo", + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "operation_type" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "user_agent", + "operation_type", + "created_at", + "actor", + "org", + "action", + "actor_id", + "repo", + "repo_id", + "org_id", + "@timestamp", + "_document_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "actor", + "operation_type", + "created_at", + "user_agent", + "action", + "actor_id", + "repo", + "repo_id", + "@timestamp", + "_document_id" + ] }, { "action": "repo.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "repo", + "user_id", + "visibility", + "repo_id", + "user", + "actor_id", + "action", + "operation_type", + "request_category", + "@timestamp", + "created_at", + "_document_id", + "actor", + "user_agent", + "org", + "oauth_application_id", + "org_id", + "request_method", + "business", + "business_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "visibility", + "integration", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "repo", + "_document_id", + "user_agent", + "user_id", + "actor", + "action", + "user", + "repo_id", + "operation_type", + "request_category", + "actor_id", + "visibility", + "created_at", + "@timestamp", + "request_method", + "oauth_application_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.download_zip", "description": "A source code archive of a repository was downloaded as a ZIP file.", - "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives" + "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "@timestamp", + "visibility", + "repo", + "repo_id", + "user", + "actor_id", + "user_agent", + "user_id", + "created_at", + "_document_id", + "action", + "operation_type", + "programmatic_access_type" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user", + "_document_id", + "user_id", + "visibility", + "action", + "user_agent", + "operation_type", + "repo_id", + "created_at", + "@timestamp", + "actor", + "repo", + "programmatic_access_type" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "user_id", + "action", + "user", + "repo", + "user_agent", + "_document_id", + "actor_id", + "@timestamp", + "actor", + "visibility", + "operation_type", + "repo_id", + "programmatic_access_type" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "actor_id", + "repo_id", + "_document_id", + "user_agent", + "actor", + "visibility", + "user_id", + "repo", + "@timestamp", + "operation_type", + "action", + "created_at", + "programmatic_access_type" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "user_agent", + "user_id", + "created_at", + "visibility", + "actor", + "actor_id", + "user", + "operation_type", + "repo_id", + "action", + "repo", + "_document_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "repo.pages_soft_delete", "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.pages_soft_delete_restore", "description": "A GitHub Pages site that was previously soft-deleted was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "actor_id", + "operation_type", + "user_agent", + "actor", + "@timestamp", + "repo_id", + "user", + "_document_id", + "visibility", + "repo", + "created_at", + "action", + "programmatic_access_type" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "actor_id", + "repo", + "operation_type", + "action", + "@timestamp", + "actor", + "user_agent", + "created_at", + "_document_id", + "repo_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "integration", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "user", + "business", + "action", + "actor_id", + "org", + "org_id", + "actor", + "created_at", + "repo_id", + "user_agent", + "business_id", + "user_id", + "operation_type", + "@timestamp", + "_document_id", + "visibility", + "repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "actor_id", + "repo_id", + "@timestamp", + "_document_id", + "repo", + "org_id", + "action", + "operation_type", + "user_agent", + "actor", + "created_at", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "action", + "repo_id", + "user_agent", + "topic", + "operation_type", + "user_id", + "org", + "org_id", + "actor", + "business", + "repo", + "@timestamp", + "created_at", + "_document_id", + "actor_id", + "business_id", + "programmatic_access_type" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "user_agent", + "@timestamp", + "actor_id", + "actor", + "old_name", + "repo", + "user_id", + "created_at", + "user", + "action", + "operation_type", + "visibility", + "repo_id", + "_document_id", + "programmatic_access_type" + ] }, { "action": "repo.rename_branch", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "old_branch", + "new_branch", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "action", + "_document_id", + "actor_id", + "user", + "operation_type", + "user_agent", + "repo_id", + "@timestamp", + "created_at", + "actor", + "user_id" + ] }, { "action": "repo.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "repo_id", + "repo", + "org_id", + "org", + "runner_id", + "runner_name", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp" + ] }, { "action": "repo.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "repo_id", + "repo", + "org_id", + "org", + "runner_id", + "runner_name", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp" + ] }, { "action": "repo.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "repo_id", + "runner_id", + "runner_name", + "source_version", + "target_version", + "runner_group_id", + "runner_group_name" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "policy", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "policy", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "limit", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "repo", + "repo_id", + "public_repo", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "policy", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "repo", + "repo_id", + "public_repo", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "created_at", + "actor", + "repo_id", + "action", + "org", + "org_id", + "repo", + "operation_type" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "user_id", + "_document_id", + "actor_id", + "repo_id", + "owner", + "user", + "old_user", + "action", + "operation_type", + "created_at", + "user_agent", + "repo", + "visibility", + "repo_was", + "actor" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "visibility", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "operation_type", + "user_id", + "user", + "action", + "user_agent", + "created_at", + "actor", + "visibility", + "repo_id", + "actor_id", + "repo" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "actor", + "actor_id", + "repo", + "operation_type", + "created_at", + "_document_id", + "repo_id", + "user", + "@timestamp", + "visibility", + "user_agent", + "user_id", + "action", + "programmatic_access_type" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "policy", + "old_policy", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "new_policy", + "old_policy", + "updated_access_policy", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "visibility", + "integration", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "action", + "_document_id", + "actor", + "repo_id", + "created_at", + "oauth_application_id", + "user", + "@timestamp", + "repo", + "operation_type", + "org_id", + "actor_id", + "visibility", + "old_permission", + "org", + "user_id", + "old_base_role", + "old_repo_permission", + "old_repo_base_role", + "new_repo_base_role", + "new_repo_permission", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repository_advisory.close", "description": "Someone closed a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", + "fields": [ + "actor", + "repo", + "@timestamp", + "business", + "business_id", + "user_agent", + "actor_id", + "action", + "operation_type", + "created_at", + "repo_id", + "_document_id", + "org", + "org_id" + ] }, { "action": "repository_advisory.cve_request", "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "repo", + "org_id", + "actor", + "action", + "org", + "operation_type", + "@timestamp", + "user_agent", + "actor_id", + "_document_id", + "created_at" + ] }, { "action": "repository_advisory.github_broadcast", "description": "GitHub made a security advisory public in the GitHub Advisory Database.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "repository_advisory.github_withdraw", "description": "GitHub withdrew a security advisory that was published in error.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repository_advisory.open", "description": "Someone opened a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user_agent", + "actor_id", + "actor", + "repo", + "created_at", + "_document_id", + "repo_id", + "action", + "@timestamp" + ] }, { "action": "repository_advisory.publish", "description": "Someone published a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user_agent", + "actor_id", + "@timestamp", + "actor", + "repo_id", + "_document_id", + "repo", + "business_id", + "business", + "action", + "created_at", + "org_id", + "org" + ] }, { "action": "repository_advisory.reopen", "description": "Someone reopened as draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user_agent", + "repo", + "action", + "created_at", + "@timestamp", + "actor_id", + "_document_id", + "actor", + "repo_id", + "public_repo" + ] }, { "action": "repository_advisory.update", "description": "Someone edited a draft or published security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "repo_id", + "org_id", + "business", + "actor", + "user_agent", + "created_at", + "_document_id", + "business_id", + "repo", + "action", + "operation_type", + "org", + "@timestamp" + ] }, { "action": "repository_branch_protection_evaluation.disable", "description": "Branch protections were disabled for the repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "org", + "org_id", + "business_id", + "user", + "user_id", + "business", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repository_branch_protection_evaluation.enable", "description": "Branch protections were enabled for this repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "org", + "org_id", + "business_id", + "user", + "user_id", + "business", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repository_content_analysis.disable", "description": "Data use settings were disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "user", + "repo_id", + "actor_id", + "created_at", + "user_agent", + "action", + "operation_type", + "actor", + "repo", + "user_id", + "@timestamp", + "_document_id" + ] }, { "action": "repository_content_analysis.enable", "description": "Data use settings were enabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "user", + "org", + "user_id", + "repo_id", + "@timestamp", + "actor", + "action", + "operation_type", + "created_at", + "actor_id", + "repo", + "user_agent", + "org_id", + "_document_id" + ] }, { "action": "repository_dependency_graph.disable", "description": "The dependency graph was disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "repo_id", + "operation_type", + "user_id", + "repo", + "_document_id", + "actor", + "user", + "action", + "@timestamp", + "org_id", + "actor_id", + "org", + "created_at", + "user_agent", + "programmatic_access_type" + ] }, { "action": "repository_dependency_graph.enable", "description": "The dependency graph was enabled for a private repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "org", + "org_id", + "action", + "repo", + "user_id", + "created_at", + "user_agent", + "actor_id", + "repo_id", + "operation_type", + "actor", + "@timestamp", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "operation_type", + "created_at", + "actor_id", + "repo_id", + "action", + "actor", + "content_type", + "repo", + "@timestamp", + "_document_id", + "user", + "user_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "content_type", + "created_at", + "actor_id", + "user_id", + "operation_type", + "_document_id", + "actor", + "repo_id", + "user_agent", + "repo", + "user", + "action", + "@timestamp" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "created_at", + "repo", + "invitee", + "operation_type", + "actor", + "repo_id", + "_document_id", + "action", + "user_agent", + "inviter", + "@timestamp", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "inviter", + "action", + "operation_type", + "_document_id", + "repo_id", + "repo", + "@timestamp", + "user_agent", + "invitee", + "created_at", + "actor", + "actor_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "actor", + "actor_id", + "@timestamp", + "invitee", + "action", + "inviter", + "repo", + "created_at", + "user_agent", + "repo_id", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "_document_id", + "actor", + "invitee", + "action", + "@timestamp", + "actor_id", + "operation_type", + "created_at", + "inviter", + "user_agent", + "repo_id" + ] }, { "action": "repository_projects_change.clear", "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", + "fields": [ + "created_at", + "_document_id", + "action", + "user_agent", + "user", + "business_id", + "business", + "operation_type", + "actor", + "actor_id", + "user_id", + "@timestamp" + ] }, { "action": "repository_projects_change.disable", "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "@timestamp", + "repo", + "action", + "operation_type", + "_document_id", + "actor_id", + "user", + "user_id", + "user_agent", + "repo_id", + "actor", + "programmatic_access_type" + ] }, { "action": "repository_projects_change.enable", "description": "Repository projects were enabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "actor", + "repo_id", + "org", + "user", + "user_agent", + "created_at", + "org_id", + "action", + "user_id", + "operation_type", + "_document_id", + "actor_id", + "repo" + ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "ruleset_id", + "ruleset_name", + "ruleset_enforcement", + "ruleset_source_type", + "ruleset_rules", + "ruleset_conditions", + "ruleset_bypass_actors" + ] }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", + "fields": [ + "actor", + "actor_id", + "user_agent", + "old_name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "ruleset_id", + "ruleset_name", + "ruleset_enforcement", + "ruleset_source_type", + "ruleset_rules_updated", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_old_enforcement", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_old_name", + "ruleset_conditions_updated", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo" + ] }, { "action": "repository_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo" + ] }, { "action": "repository_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo" + ] }, { "action": "repository_secret_scanning.disable", "description": "Secret scanning was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "repository_secret_scanning.enable", "description": "Secret scanning was enabled for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "repository_secret_scanning_generic_secrets.disabled", "description": "Generic secrets have been disabled at the repository level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_generic_secrets.enabled", "description": "Generic secrets have been enabled at the repository level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_push_protection.disable", "description": "Secret scanning push protection was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "repository_secret_scanning_push_protection.enable", "description": "Secret scanning push protection was enabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "repository_visibility_change.clear", "description": "The repository visibility change setting was cleared for an organization or enterprise.", - "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility" + "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", + "fields": [ + "created_at", + "_document_id", + "actor_id", + "business", + "action", + "operation_type", + "user", + "user_id", + "business_id", + "@timestamp", + "user_agent", + "actor" + ] }, { "action": "repository_visibility_change.disable", "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "org_id", + "created_at", + "user_agent", + "actor", + "actor_id", + "org", + "operation_type", + "_document_id", + "@timestamp", + "user_id", + "action" + ] }, { "action": "repository_visibility_change.enable", "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "operation_type", + "_document_id", + "@timestamp", + "user_agent", + "user", + "created_at", + "org", + "org_id", + "action", + "actor_id", + "user_id" + ] }, { "action": "repository_vulnerability_alert.auto_dismiss", "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", + "fields": [ + "actor", + "actor_id", + "user_agent", + "alert_number", + "ghsa_id", + "action", + "repo", + "repo_id", + "public_repo", + "owner", + "org", + "org_id", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repository_vulnerability_alert.auto_reopen", "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", + "fields": [ + "actor", + "actor_id", + "user_agent", + "alert_number", + "ghsa_id", + "action", + "repo", + "repo_id", + "public_repo", + "owner", + "org", + "org_id", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repository_vulnerability_alert.create", "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", + "fields": [ + "operation_type", + "repo_id", + "@timestamp", + "user_agent", + "action", + "repo", + "created_at", + "_document_id", + "token_scopes", + "alert_number", + "programmatic_access_type" + ] }, { "action": "repository_vulnerability_alert.dismiss", "description": "A Dependabot alert was manually dismissed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "org_id", + "user_id", + "@timestamp", + "operation_type", + "user_agent", + "actor", + "repo", + "created_at", + "org", + "_document_id", + "action", + "actor_id", + "dismiss_reason", + "user", + "dismiss_comment", + "alert_number", + "actor_is_bot" + ] }, { "action": "repository_vulnerability_alert.reintroduce", "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "action", + "repo", + "repo_id", + "public_repo", + "owner", + "_document_id", + "@timestamp", + "operation_type", + "token_scopes", + "alert_number" + ] }, { "action": "repository_vulnerability_alert.reopen", "description": "A Dependabot alert was manually reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "action", + "repo", + "repo_id", + "owner", + "org", + "org_id", + "_document_id", + "@timestamp", + "operation_type", + "business", + "business_id", + "public_repo", + "alert_number" + ] }, { "action": "repository_vulnerability_alert.resolve", "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "operation_type", + "action", + "repo_id", + "_document_id", + "user_agent", + "@timestamp", + "created_at", + "actor", + "actor_id", + "token_scopes", + "alert_number", + "programmatic_access_type" + ] }, { "action": "repository_vulnerability_alerts.authorized_users_teams", "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", + "fields": [ + "org", + "_document_id", + "repo", + "org_id", + "operation_type", + "created_at", + "actor", + "action", + "@timestamp", + "user_agent", + "repo_id", + "actor_id" + ] }, { "action": "repository_vulnerability_alerts_auto_dismissal.disable", "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repository_vulnerability_alerts_auto_dismissal.enable", "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_vulnerability_alerts.disable", "description": "Dependabot alerts was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "repo_id", + "action", + "actor_id", + "@timestamp", + "created_at", + "actor", + "user_agent", + "org_id", + "user", + "org", + "_document_id", + "user_id", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repository_vulnerability_alerts.enable", "description": "Dependabot alerts was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "user_agent", + "created_at", + "@timestamp", + "repo_id", + "action", + "user", + "repo", + "org", + "org_id", + "actor_id", + "_document_id", + "user_id", + "operation_type", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "required_status_check.create", "description": "A status check was marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "org", + "actor_id", + "@timestamp", + "business", + "context", + "repo_id", + "action", + "repo", + "_document_id", + "operation_type", + "business_id", + "org_id", + "actor", + "created_at", + "user_agent", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "required_status_check.destroy", "description": "A status check was no longer marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "actor_id", + "actor", + "created_at", + "context", + "operation_type", + "@timestamp", + "org", + "user_agent", + "repo_id", + "org_id", + "action", + "_document_id", + "repo", + "programmatic_access_type" + ] }, { "action": "restrict_notification_delivery.disable", "description": "Email notification restrictions for an organization or enterprise were disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "restrict_notification_delivery.enable", "description": "Email notification restrictions for an organization or enterprise were enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "role.create", "description": "A new custom repository role was created.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "name", + "owner", + "base_role", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "role_permissions", + "old_role_permissions" + ] }, { "action": "role.destroy", "description": "A custom repository role was deleted.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "name", + "owner", + "role_permissions", + "base_role", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "role.update", "description": "A custom repository role was edited.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "owner", + "role_permissions", + "base_role", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "old_role_permissions", + "old_base_role" + ] }, { "action": "secret_scanning_alert.create", "description": "GitHub detected a secret and created a secret scanning alert.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "repo_id", + "repo", + "actor_id", + "actor", + "org_id", + "org", + "business", + "business_id", + "number" + ] }, { "action": "secret_scanning_alert.reopen", "description": "A seret scanning alert was reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "number", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes" + ] }, { "action": "secret_scanning_alert.resolve", "description": "A seret scanning alert was resolved.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "number", + "resolution", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes" + ] }, { "action": "secret_scanning_alert.revoke", "description": "A secret scanning alert was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "number", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "secret_scanning_alert.validate", "description": "A secret scanning alert was validated.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "repo_id", + "repo", + "actor_id", + "actor", + "org_id", + "org", + "business", + "business_id", + "number", + "created_at", + "previous_validity", + "current_validity" + ] }, { "action": "secret_scanning.disable", "description": "Secret scanning was disabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "secret_scanning.enable", "description": "Secret scanning was enabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "secret_scanning_new_repos.disable", "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "secret_scanning_new_repos.enable", "description": "Secret scanning was enabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "secret_scanning_push_protection.bypass", "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", + "fields": [ + "repo_id", + "repo", + "actor_id", + "actor", + "org_id", + "org", + "business", + "business_id", + "number", + "created_at", + "push_protection_bypass_reason" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.invoiced_agreement_sign", "description": "An agreement for invoiced billing for GitHub Sponsors was signed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org_id", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "action", + "created_at", + "_document_id", + "actor", + "user_agent", + "actor_id", + "operation_type" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "operation_type", + "_document_id", + "created_at", + "actor", + "user", + "action", + "actor_id", + "user_id", + "@timestamp" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "actor", + "user_id", + "action", + "@timestamp", + "user_agent", + "user", + "operation_type", + "created_at", + "actor_id", + "_document_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "active", + "user", + "user_id", + "actor", + "actor_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "actor_id", + "action", + "@timestamp", + "user_id", + "created_at", + "user", + "_document_id", + "user_agent", + "actor", + "operation_type" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "user_id", + "actor", + "actor_id", + "action", + "user", + "operation_type", + "@timestamp", + "_document_id", + "created_at" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "user_id", + "action", + "user_agent", + "actor", + "user", + "operation_type", + "@timestamp", + "created_at", + "actor_id", + "_document_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "user_id", + "operation_type", + "actor_id", + "@timestamp", + "_document_id", + "user", + "action", + "created_at", + "user_agent", + "actor" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "actor_id", + "operation_type", + "created_at", + "user_agent", + "actor", + "action", + "_document_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "created_at", + "user", + "action", + "user_agent", + "operation_type", + "_document_id", + "actor", + "actor_id", + "user_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "user_agent", + "user", + "@timestamp", + "actor_id", + "user_id", + "_document_id", + "actor", + "action", + "operation_type", + "created_at" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "operation_type", + "actor", + "user_id", + "action", + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "user", + "created_at" + ] }, { "action": "sponsors.sponsors_patreon_user_create", "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", + "fields": [ + "actor", + "actor_id", + "user_agent", + "patreon_email", + "patreon_username", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.sponsors_patreon_user_destroy", "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", + "fields": [ + "actor", + "actor_id", + "user_agent", + "patreon_email", + "patreon_username", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "ssh_certificate_authority.create", "description": "An SSH certificate authority for an organization or enterprise was created.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "fingerprint", + "operation_type", + "openssh_public_key", + "org_id", + "actor", + "created_at", + "org", + "action", + "user_agent", + "actor_id" + ] }, { "action": "ssh_certificate_authority.destroy", "description": "An SSH certificate authority for an organization or enterprise was deleted.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "created_at", + "_document_id", + "fingerprint", + "operation_type", + "actor", + "org_id", + "openssh_public_key", + "org", + "action", + "user_agent", + "actor_id", + "@timestamp" + ] }, { "action": "ssh_certificate_requirement.disable", "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "user", + "user_agent", + "operation_type", + "_document_id", + "org", + "org_id", + "created_at", + "actor", + "action", + "user_id", + "business", + "business_id", + "@timestamp", + "actor_id" + ] }, { "action": "ssh_certificate_requirement.enable", "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "actor_id", + "user_id", + "org", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "user", + "action", + "org_id", + "created_at", + "user_agent" + ] }, { "action": "staff.dependabot_debug_credentials_generated", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "staff.set_domain_token_expiration", "description": "The verification code expiry time for an organization or enterprise domain was set.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner_type", + "business_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "staff.unverify_domain", "description": "An organization or enterprise domain was unverified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "owner_type", + "owner", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "staff.verify_domain", "description": "An organization or enterprise domain was verified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "team.add_member", "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", + "fields": [ + "user_agent", + "org_id", + "user_id", + "team", + "user", + "@timestamp", + "actor_id", + "created_at", + "operation_type", + "_document_id", + "org", + "action", + "actor", + "programmatic_access_type" + ] }, { "action": "team.add_repository", "description": "A team was given access and permissions to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "team", + "action", + "operation_type", + "created_at", + "@timestamp", + "org", + "repo", + "actor_id", + "_document_id", + "repo_id", + "user_agent", + "org_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "team.change_parent_team", "description": "A child team was created or a child team's parent was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" + "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", + "fields": [ + "org", + "@timestamp", + "created_at", + "_document_id", + "team", + "action", + "operation_type", + "actor", + "actor_id", + "user_agent", + "org_id", + "programmatic_access_type" + ] }, { "action": "team.change_privacy", "description": "A team's privacy level was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility" + "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", + "fields": [ + "user_agent", + "org", + "action", + "team", + "created_at", + "operation_type", + "actor_id", + "org_id", + "@timestamp", + "actor", + "_document_id" + ] }, { "action": "team.create", "description": "A new team is created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "oauth_application_id", + "action", + "operation_type", + "@timestamp", + "org_id", + "user_agent", + "team", + "org", + "actor", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "team.demote_maintainer", "description": "A user was demoted from a team maintainer to a team member.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", + "fields": [ + "user_agent", + "actor", + "actor_id", + "team", + "org", + "org_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "team.destroy", "description": "A team was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "org", + "team", + "org_id", + "actor_id", + "actor", + "action", + "@timestamp", + "user_agent", + "operation_type", + "_document_id", + "programmatic_access_type" + ] }, { "action": "team_discussions.clear", "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "business_id", + "operation_type", + "@timestamp", + "user_agent", + "actor", + "actor_id", + "user", + "business", + "action", + "created_at", + "user_id", + "_document_id" + ] }, { "action": "team_discussions.disable", "description": "Team discussions were disabled for an organization.", - "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization" + "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization", + "fields": [ + "org_id", + "action", + "operation_type", + "actor", + "org", + "created_at", + "actor_id", + "user", + "user_id", + "@timestamp", + "user_agent", + "_document_id" + ] }, { "action": "team_discussions.enable", "description": "Team discussions were enabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "@timestamp", + "action", + "_document_id", + "user_agent", + "user_id", + "business_id", + "user", + "business", + "operation_type", + "actor", + "created_at" + ] }, { "action": "team_group_mapping.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "actor", + "action", + "operation_type", + "team", + "@timestamp", + "actor_id", + "org", + "_document_id", + "org_id", + "user_agent" + ] }, { "action": "team_group_mapping.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "@timestamp", + "actor_id", + "_document_id", + "team", + "created_at", + "org_id", + "action", + "user_agent", + "actor", + "org" + ] }, { "action": "team_group_mapping.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "team", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "team.promote_maintainer", "description": "A user was promoted from a team member to a team maintainer.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", + "fields": [ + "user_agent", + "actor", + "actor_id", + "team", + "org", + "org_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "team.remove_member", "description": "An organization member was removed from a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", + "fields": [ + "operation_type", + "created_at", + "actor_id", + "org", + "org_id", + "team", + "user_id", + "actor", + "user", + "action", + "@timestamp", + "user_agent", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "repo", + "repo_id", + "action", + "_document_id", + "actor", + "@timestamp", + "actor_id", + "user_agent", + "created_at", + "team", + "org", + "operation_type", + "programmatic_access_type" + ] }, { "action": "team.rename", "description": "A team's name was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "name", + "user_agent", + "created_at", + "team", + "operation_type", + "actor_id", + "org", + "action", + "actor", + "org_id", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "team_sync_tenant.disabled", "description": "Team synchronization with a tenant was disabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "action", + "created_at", + "actor", + "org_id", + "actor_id", + "operation_type", + "_document_id", + "@timestamp", + "org", + "user_agent" + ] }, { "action": "team_sync_tenant.enabled", "description": "Team synchronization with a tenant was enabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "org_id", + "business_id", + "actor", + "created_at", + "user_agent", + "@timestamp", + "operation_type", + "business", + "actor_id", + "org", + "action", + "_document_id" + ] }, { "action": "team_sync_tenant.update_okta_credentials", "description": "The Okta credentials for team synchronization with a tenant were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "team", + "org_id", + "@timestamp", + "org", + "_document_id", + "old_permission", + "repo", + "action", + "repo_id", + "actor", + "operation_type", + "created_at", + "user_agent", + "permission", + "new_repo_permission", + "new_repo_base_role", + "old_repo_permission", + "old_repo_base_role", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "vulnerability_alert_rule.create", "description": "A Dependabot rule was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "vulnerability_alert_rule.delete", "description": "A Dependabot rule was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "vulnerability_alert_rule.disable", "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "vulnerability_alert_rule.enable", "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "vulnerability_alert_rule.force_disable", "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "action", + "org", + "org_id", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "vulnerability_alert_rule.force_enable", "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "action", + "org", + "org_id", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "vulnerability_alert_rule.update", "description": "A Dependabot rule's conditions, actions, or metadata changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "user_agent", + "actor", + "actor_id", + "workflow_run_id", + "run_number", + "user", + "user_id", + "repo", + "repo_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "workflow_run_id", + "run_number", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "workflows.cancel_workflow_run", "description": "A workflow run was cancelled.", - "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow" + "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "started_at", + "event", + "name", + "workflow_run_id", + "head_branch", + "head_sha", + "run_number", + "cancelled_at", + "workflow_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "business", + "business_id", + "trigger_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "token_id", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "workflow_run_id", + "run_number", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "workflows.completed_workflow_run", "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history" + "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "started_at", + "event", + "name", + "workflow_run_id", + "head_branch", + "head_sha", + "completed_at", + "conclusion", + "run_number", + "workflow_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "business", + "business_id", + "trigger_id", + "run_attempt", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "workflows.created_workflow_run", "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow" + "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "started_at", + "event", + "name", + "workflow_run_id", + "head_branch", + "head_sha", + "workflow_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "business", + "business_id", + "trigger_id", + "public_repo", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "workflow_run_id", + "started_at", + "head_branch", + "head_sha", + "trigger_id", + "programmatic_access_type" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "workflow_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "workflow_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "workflows.prepared_workflow_job", "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows" + "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", + "fields": [ + "repo_id", + "repo", + "org_id", + "org", + "business_id", + "business", + "workflow_run_id", + "job_name", + "runner_labels", + "is_hosted_runner", + "environment_name", + "secrets_passed", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp", + "runner_owner_type", + "job_workflow_ref", + "calling_workflow_refs", + "calling_workflow_shas", + "imposer_repo" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "user_agent", + "actor", + "actor_id", + "workflow_run_id", + "run_number", + "user", + "user_id", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "workflows.rerun_workflow_run", "description": "A workflow run was re-run.", - "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs" + "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "started_at", + "event", + "name", + "workflow_run_id", + "head_branch", + "head_sha", + "run_number", + "workflow_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "business", + "business_id", + "trigger_id", + "run_attempt", + "rerun_type", + "check_run_id", + "programmatic_access_type", + "actor_is_bot" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/fpt/user.json b/src/audit-logs/data/fpt/user.json index d39c9dadd90a..1c26212c7059 100644 --- a/src/audit-logs/data/fpt/user.json +++ b/src/audit-logs/data/fpt/user.json @@ -2,1851 +2,7234 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "@timestamp", + "operation_type", + "user_agent", + "_document_id", + "created_at", + "action", + "actor", + "actor_id", + "org_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "actor", + "operation_type", + "_document_id", + "user_agent", + "created_at", + "actor_id", + "@timestamp", + "user", + "action", + "user_id", + "programmatic_access_type" + ] }, { "action": "account_recovery_token.confirm", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "action", + "@timestamp", + "user_agent", + "created_at", + "_document_id", + "token_id", + "user_id", + "user", + "actor", + "operation_type" + ] }, { "action": "account_recovery_token.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "created_at", + "token_id", + "user", + "_document_id", + "user_agent", + "actor", + "user_id", + "actor_id", + "operation_type", + "@timestamp" + ] }, { "action": "account_recovery_token.recover", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "@timestamp", + "actor_id", + "operation_type", + "created_at", + "actor", + "user_agent", + "action", + "_document_id", + "user_id", + "token_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "user_id", + "user", + "repo_id", + "repo", + "org", + "org_id", + "actions_cache_id", + "actions_cache_key", + "actions_cache_version", + "actions_cache_scope", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "actor", + "user_agent", + "actor_id", + "repo", + "repo_id", + "@timestamp", + "created_at", + "_document_id", + "operation_type", + "programmatic_access_type" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "actor_id", + "user", + "@timestamp", + "actor", + "user_id", + "action", + "created_at", + "operation_type", + "_document_id", + "user_agent" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "actor", + "operation_type", + "actor_id", + "org_id", + "@timestamp", + "user_agent", + "created_at", + "_document_id", + "org", + "email", + "action" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "oauth_application_id", + "@timestamp", + "actor_id", + "operation_type", + "_document_id", + "actor", + "user", + "user_id", + "user_agent", + "created_at", + "action" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user", + "operation_type", + "user_agent", + "created_at", + "user_id", + "actor", + "action", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "billing.update_bill_cycle_day", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.set_actions_fork_pr_approvals_policy", "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "policy", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "policy", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "limit", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "business.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "policy", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "business.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "visibility", + "user_agent", + "user", + "@timestamp", + "repo", + "actor_id", + "user_id", + "action", + "created_at", + "actor", + "operation_type", + "repo_id", + "_document_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "actor", + "actor_id", + "operation_type", + "repo_id", + "action", + "created_at", + "_document_id", + "user_agent", + "repo", + "programmatic_access_type" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "origin_repository", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "user_id", + "org_id", + "owner", + "name", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot", + "machine_type", + "devcontainer_path" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "owner", + "name", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot", + "machine_type", + "devcontainer_path" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "owner", + "name", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "owner", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.start_environment", "description": "A codespace was started.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "org", + "owner", + "pull_request_id", + "machine_type", + "user_id", + "user", + "devcontainer_path", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "user_agent", + "actor", + "actor_id", + "business", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "copilot.cfb_seat_added", "description": "A seat was added to the Copilot Business subscription for a user and they have received access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "token_id", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_assignment_created", "description": "A seat assignment was newly created for a user.", - "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business" + "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", + "fields": [ + "actor", + "actor_id", + "user_agent", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.cfb_seat_assignment_refreshed", "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_assignment_reused", "description": "A seat assignment was re-created for a user who already had a seat with no pending cancellation date.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.cfb_seat_assignment_unassigned", "description": "A seat was unassigned from a user and they will lose access to GitHub Copilot at the end of the billing cycle.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_cancelled", "description": "A seat was canceled from the Copilot Business subscription and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "seat_assignment" + ] }, { "action": "copilot.cfb_seat_cancelled_by_staff", "description": "A seat was canceled from the Copilot Business subscription manually by GitHub and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user_id", + "user", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "environment_name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "environment_name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "public_repo", + "token_scopes" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "environment_name", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "environment_name", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "git_signing_ssh_public_key.create", "description": "An SSH key was added to a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "actor", + "actor_id", + "user_agent", + "title", + "key", + "fingerprint", + "user_id", + "user", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes" + ] }, { "action": "git_signing_ssh_public_key.delete", "description": "An SSH key was removed from a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "actor", + "actor_id", + "user_agent", + "title", + "key", + "fingerprint", + "user_id", + "explanation", + "user", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "runner_group_id", + "business", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "business", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "runner_group_id", + "business", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "gpg_key.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "created_at", + "user_id", + "@timestamp", + "user", + "operation_type", + "_document_id", + "actor", + "action", + "user_agent" + ] }, { "action": "gpg_key.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "operation_type", + "actor", + "actor_id", + "user", + "action", + "created_at", + "_document_id", + "user_agent", + "@timestamp" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "name", + "events", + "active", + "active_was", + "hook_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "name", + "org", + "user_agent", + "hook_id", + "repo", + "repo_id", + "created_at", + "oauth_application_id", + "action", + "events", + "org_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "oauth_application", + "_document_id", + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "repo_id", + "hook_id", + "events", + "repo", + "@timestamp", + "operation_type", + "name", + "action", + "created_at", + "org_id", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "events", + "repo", + "created_at", + "org", + "name", + "actor_id", + "repo_id", + "org_id", + "action", + "operation_type", + "oauth_application_id", + "user_agent", + "hook_id", + "@timestamp", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "events", + "repo", + "operation_type", + "action", + "_document_id", + "actor_id", + "name", + "events_were", + "@timestamp", + "created_at", + "hook_id", + "repo_id", + "org_id", + "org", + "user_agent", + "oauth_application_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "action", + "operation_type", + "@timestamp", + "actor", + "user_agent", + "actor_id", + "name", + "user_id", + "_document_id", + "integration", + "created_at", + "programmatic_access_type" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "user_id", + "actor_id", + "@timestamp", + "name", + "integration", + "user", + "_document_id", + "action", + "operation_type", + "created_at", + "user_agent" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "operation_type", + "@timestamp", + "name", + "repository_selection", + "user_id", + "action", + "user_agent", + "user", + "created_at", + "integration", + "_document_id", + "programmatic_access_type" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "actor", + "created_at", + "_document_id", + "repository_selection", + "integration", + "user_id", + "user", + "action", + "operation_type", + "name", + "actor_id", + "user_agent", + "programmatic_access_type" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "user_id", + "repository_selection", + "name", + "user", + "integration", + "operation_type", + "actor_id", + "action", + "repositories_added", + "created_at", + "_document_id", + "@timestamp", + "actor", + "user_agent", + "token_scopes", + "repositories_added_names", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "user", + "operation_type", + "user_agent", + "actor", + "repository_selection", + "repositories_removed", + "integration", + "user_id", + "created_at", + "_document_id", + "@timestamp", + "name", + "action", + "actor_id", + "repositories_removed_names", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "user_agent", + "name", + "repository_selection", + "actor_id", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "user_agent", + "name", + "repository_selection", + "actor_id", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "integration", + "user_id", + "user_agent", + "name", + "user", + "operation_type", + "actor_id", + "action", + "_document_id", + "created_at", + "repository_selection", + "@timestamp", + "actor" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "created_at", + "action", + "_document_id", + "name", + "org_id", + "manager", + "operation_type", + "actor", + "integration", + "org", + "@timestamp", + "actor_id", + "user_agent" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "user_agent", + "actor_id", + "org", + "operation_type", + "integration", + "org_id", + "_document_id", + "action", + "actor", + "name", + "created_at", + "manager", + "@timestamp" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation" + "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "integration", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "user_id", + "name", + "user", + "action", + "actor_id", + "created_at", + "_document_id", + "user_agent", + "operation_type", + "actor", + "integration" + ] }, { "action": "integration.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation" + "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "integration", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "@timestamp", + "_document_id", + "user_agent", + "operation_type", + "created_at", + "action", + "user", + "user_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "secondary_category", + "actor", + "primary_category", + "user", + "@timestamp", + "_document_id", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_id", + "marketplace_listing", + "integration", + "action" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "primary_category", + "user_agent", + "actor", + "marketplace_listing", + "@timestamp", + "integration", + "org_id", + "action", + "org", + "secondary_category", + "operation_type", + "created_at", + "actor_id", + "_document_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "primary_category", + "_document_id", + "user", + "created_at", + "user_agent", + "oauth_application", + "action", + "marketplace_listing", + "user_id", + "secondary_category", + "oauth_application_id", + "actor", + "actor_id", + "operation_type", + "@timestamp" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "actor", + "actor_id", + "user_agent", + "org_id", + "created_at", + "secondary_category", + "operation_type", + "marketplace_listing", + "action", + "@timestamp", + "_document_id", + "primary_category", + "integration" + ] }, { "action": "marketplace_listing_plan.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "created_at", + "actor", + "action", + "operation_type", + "marketplace_listing", + "has_free_trial", + "user_agent", + "actor_id", + "yearly_price_in_cents", + "description", + "bullets", + "monthly_price_in_cents", + "marketplace_listing_plan", + "_document_id" + ] }, { "action": "marketplace_listing_plan.publish", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "marketplace_listing_plan", + "marketplace_listing", + "description", + "bullets", + "has_free_trial", + "created_at", + "actor_id", + "operation_type", + "_document_id", + "action", + "user_agent", + "actor", + "monthly_price_in_cents", + "yearly_price_in_cents", + "@timestamp" + ] }, { "action": "marketplace_listing_plan.retire", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "marketplace_listing_plan", + "_document_id", + "description", + "yearly_price_in_cents", + "@timestamp", + "created_at", + "actor_id", + "bullets", + "has_free_trial", + "marketplace_listing", + "user_agent", + "monthly_price_in_cents", + "action", + "operation_type" + ] }, { "action": "marketplace_listing_plan.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "monthly_price_in_cents", + "marketplace_listing", + "_document_id", + "action", + "description", + "bullets", + "yearly_price_in_cents", + "actor_id", + "has_free_trial", + "marketplace_listing_plan", + "user_agent", + "@timestamp", + "operation_type", + "actor", + "created_at" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "secondary_category", + "oauth_application_id", + "@timestamp", + "action", + "user_agent", + "user_id", + "operation_type", + "oauth_application", + "actor", + "created_at", + "marketplace_listing", + "actor_id", + "primary_category", + "user" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "primary_category", + "secondary_category", + "marketplace_listing", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "max_entries_to_build", + "min_entries_to_merge", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "@timestamp", + "_document_id", + "user_id", + "action", + "operation_type", + "created_at" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "action", + "org", + "created_at", + "operation_type", + "org_id", + "@timestamp", + "_document_id", + "user_agent", + "actor" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "org_id", + "_document_id", + "org", + "repo_id", + "action", + "actor", + "created_at", + "operation_type", + "@timestamp", + "user_agent", + "actor_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "oauth_access.create", "description": "An OAuth access token was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", + "fields": [ + "_document_id", + "operation_type", + "user_agent", + "actor", + "@timestamp", + "user", + "user_id", + "created_at", + "action", + "actor_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "oauth_access.destroy", "description": "An OAuth access token was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "user_agent", + "action", + "operation_type", + "_document_id", + "actor", + "created_at", + "user", + "user_id", + "explanation", + "hashed_token", + "actor_id", + "token_scopes" + ] }, { "action": "oauth_access.regenerate", "description": "An OAuth access token was regenerated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "user_id", + "_document_id", + "created_at", + "@timestamp", + "operation_type", + "action", + "user_agent", + "actor", + "actor_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "oauth_access.update", "description": "An OAuth access token was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "actor", + "operation_type", + "_document_id", + "user_id", + "created_at", + "action", + "@timestamp", + "user", + "user_agent" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "org", + "created_at", + "oauth_application_id", + "operation_type", + "user_agent", + "actor_id", + "org_id", + "action", + "actor", + "oauth_application", + "@timestamp", + "_document_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "created_at", + "oauth_application_id", + "user_id", + "operation_type", + "@timestamp", + "user_agent", + "oauth_application", + "_document_id", + "actor", + "actor_id", + "action", + "user" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user", + "user_id", + "action", + "oauth_application", + "operation_type", + "actor_id", + "_document_id", + "created_at", + "actor", + "oauth_application_id", + "@timestamp", + "user_agent" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "oauth_application_id", + "oauth_application", + "actor_id", + "user_agent", + "@timestamp", + "user_id", + "action", + "_document_id", + "actor", + "user", + "created_at", + "operation_type" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "actor", + "operation_type", + "created_at", + "user_agent", + "oauth_application", + "actor_id", + "oauth_application_id", + "@timestamp", + "user_id", + "_document_id", + "user", + "action" + ] }, { "action": "oauth_authorization.create", "description": "An authorization for an OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "operation_type", + "user_agent", + "user_id", + "actor", + "org_id", + "_document_id", + "action", + "@timestamp", + "created_at", + "actor_id", + "user", + "business", + "business_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "oauth_authorization.destroy", "description": "An authorization for an OAuth application was deleted.", - "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations" + "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", + "fields": [ + "user_agent", + "_document_id", + "operation_type", + "@timestamp", + "actor", + "created_at", + "explanation", + "user", + "user_id", + "org_id", + "action", + "actor_id", + "token_scopes", + "actor_is_bot" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "permission", + "_document_id", + "org", + "operation_type", + "actor", + "user", + "@timestamp", + "created_at", + "user_agent", + "org_id", + "user_id", + "actor_id", + "action", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "inviter", + "org", + "org_id", + "repo", + "repo_id", + "public_repo", + "permission", + "invitee", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "actor_id", + "user_agent", + "actor", + "action", + "user_id", + "@timestamp", + "created_at", + "user", + "operation_type", + "org_id", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "policy", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "actor", + "actor_id", + "user_agent", + "policy", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "limit", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "policy", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "org_id", + "created_at", + "_document_id", + "user", + "user_id", + "action", + "actor_id", + "old_permission", + "permission", + "actor", + "user_agent", + "operation_type", + "org" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "action", + "@timestamp", + "actor_id", + "permission", + "created_at", + "user_agent", + "org", + "org_id", + "_document_id", + "visibility", + "operation_type" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "actor_id", + "permission", + "action", + "org_id", + "actor", + "created_at", + "_document_id", + "business_id", + "operation_type", + "org", + "user_agent", + "business", + "@timestamp" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "owner_type", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "owner_type", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "owner_type", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "passkey.register", "description": "A new passkey was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "nickname", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "passkey.remove", "description": "A new passkey was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "nickname", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "user", + "operation_type", + "user_id", + "_document_id", + "action", + "actor", + "actor_id", + "@timestamp", + "created_at" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "created_at", + "actor_id", + "@timestamp", + "user_id", + "action", + "operation_type", + "actor", + "_document_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "org_id", + "created_at", + "actor_id", + "@timestamp", + "action", + "actor", + "org", + "user_agent", + "_document_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "repository_selection", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "repository_selection", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.create", "description": "Triggered when you create a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "user", + "user_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.credential_regenerated", "description": "Triggered when you regenerate a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.credential_revoked", "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", - "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users" + "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", + "fields": [ + "user_programmatic_access_name", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.destroy", "description": "Triggered when you delete a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "user", + "user_id", + "explanation", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "org", + "org_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "user", + "user_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user_programmatic_access_name", + "org", + "org_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.update", "description": "A fine-grained personal access token was updated.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "user", + "user_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "user", + "actor_id", + "user_id", + "@timestamp", + "created_at", + "owner", + "action", + "_document_id", + "user_agent", + "actor", + "operation_type" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "actor", + "user_agent", + "operation_type", + "user", + "created_at", + "user_id", + "action", + "_document_id", + "@timestamp" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "org_id", + "user_agent", + "operation_type", + "@timestamp", + "created_at", + "repo_id", + "org", + "_document_id", + "action", + "actor", + "actor_id", + "repo" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user", + "_document_id", + "user_id", + "user_agent", + "@timestamp", + "actor_id", + "action", + "created_at", + "actor" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "actor_id", + "operation_type", + "actor", + "user_id", + "@timestamp", + "created_at", + "_document_id", + "user_agent", + "user" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "action", + "actor_id", + "org_id", + "user_agent", + "actor", + "operation_type", + "@timestamp", + "_document_id", + "created_at", + "org", + "repo" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "actor", + "actor_id", + "action", + "user_id", + "_document_id", + "user_agent", + "operation_type", + "user", + "@timestamp", + "created_at" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "created_at", + "actor_id", + "old_name", + "operation_type", + "@timestamp", + "repo", + "_document_id", + "user_agent", + "org_id", + "business_id", + "actor", + "repo_id", + "org", + "business" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "repo_id", + "operation_type", + "actor", + "action", + "created_at", + "actor_id", + "_document_id", + "@timestamp", + "user_agent", + "org", + "org_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "org", + "@timestamp", + "_document_id", + "operation_type", + "created_at", + "actor_id", + "action", + "org_id", + "user_agent" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "org_id", + "operation_type", + "org", + "actor_id", + "_document_id", + "team", + "@timestamp", + "action", + "user_agent", + "actor" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "operation_type", + "@timestamp", + "actor_id", + "user", + "user_agent", + "actor", + "created_at", + "org", + "_document_id", + "org_id", + "action", + "programmatic_access_type" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "merge_queue_enforcement_level", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "read_only", + "user_agent", + "actor_id", + "operation_type", + "created_at", + "_document_id", + "key", + "fingerprint", + "actor", + "action", + "user", + "user_id", + "@timestamp", + "title", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "fingerprint", + "user_agent", + "read_only", + "explanation", + "repo", + "@timestamp", + "action", + "key", + "operation_type", + "_document_id", + "actor", + "title", + "actor_id", + "repo_id", + "created_at", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "user_agent", + "title", + "key", + "fingerprint", + "read_only", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "created_at", + "operation_type", + "_document_id", + "title", + "key", + "action", + "actor", + "read_only", + "explanation", + "repo_id", + "@timestamp", + "actor_id", + "repo", + "user_agent", + "fingerprint" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "actor", + "user_agent", + "key", + "fingerprint", + "read_only", + "repo_id", + "operation_type", + "created_at", + "actor_id", + "repo", + "action", + "_document_id", + "title", + "@timestamp", + "programmatic_access_type" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "repo_id", + "actor", + "key", + "fingerprint", + "@timestamp", + "actor_id", + "oauth_application_id", + "title", + "action", + "user_agent", + "created_at", + "repo", + "read_only", + "operation_type", + "_document_id", + "user", + "user_id", + "programmatic_access_type" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "operation_type", + "user", + "@timestamp", + "_document_id", + "action", + "created_at", + "key", + "fingerprint", + "actor_id", + "actor", + "title", + "user_agent", + "user_id", + "read_only", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "repo_id", + "user", + "operation_type", + "@timestamp", + "actor_id", + "user_id", + "created_at", + "user_agent", + "actor", + "action", + "repo", + "visibility", + "_document_id", + "previous_visibility", + "programmatic_access_type" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "visibility", + "repo", + "created_at", + "user_agent", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "actor_id", + "repo_id", + "user", + "action", + "user_id", + "oauth_application_id", + "org", + "org_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "action", + "user_agent", + "actor", + "repo", + "repo_id", + "user", + "org", + "org_id", + "actor_id", + "topic", + "@timestamp", + "_document_id", + "user_id", + "created_at", + "operation_type", + "programmatic_access_type" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "repo_id", + "user_agent", + "user_id", + "created_at", + "@timestamp", + "repo", + "user", + "operation_type", + "visibility", + "action", + "actor_id", + "actor", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "oauth_application_id", + "user_agent", + "created_at", + "@timestamp", + "_document_id", + "actor_id", + "operation_type", + "action", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "tool", + "category" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "actor", + "actor_id", + "user_agent", + "tool", + "branch", + "category", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo_id", + "_document_id", + "action", + "created_at", + "repo", + "operation_type", + "@timestamp" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "repo", + "@timestamp", + "actor", + "_document_id", + "user_agent", + "actor_id", + "repo_id", + "action", + "operation_type", + "created_at" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "actor", + "repo_id", + "action", + "user_agent", + "_document_id", + "@timestamp", + "created_at", + "actor_id", + "repo", + "operation_type" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "actor", + "oauth_application_id", + "created_at", + "action", + "repo_id", + "repo", + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "operation_type" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "user_agent", + "operation_type", + "created_at", + "actor", + "org", + "action", + "actor_id", + "repo", + "repo_id", + "org_id", + "@timestamp", + "_document_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "actor", + "operation_type", + "created_at", + "user_agent", + "action", + "actor_id", + "repo", + "repo_id", + "@timestamp", + "_document_id" + ] }, { "action": "repo.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "repo", + "user_id", + "visibility", + "repo_id", + "user", + "actor_id", + "action", + "operation_type", + "request_category", + "@timestamp", + "created_at", + "_document_id", + "actor", + "user_agent", + "org", + "oauth_application_id", + "org_id", + "request_method", + "business", + "business_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "visibility", + "integration", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "repo", + "_document_id", + "user_agent", + "user_id", + "actor", + "action", + "user", + "repo_id", + "operation_type", + "request_category", + "actor_id", + "visibility", + "created_at", + "@timestamp", + "request_method", + "oauth_application_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "@timestamp", + "visibility", + "repo", + "repo_id", + "user", + "actor_id", + "user_agent", + "user_id", + "created_at", + "_document_id", + "action", + "operation_type", + "programmatic_access_type" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user", + "_document_id", + "user_id", + "visibility", + "action", + "user_agent", + "operation_type", + "repo_id", + "created_at", + "@timestamp", + "actor", + "repo", + "programmatic_access_type" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "user_id", + "action", + "user", + "repo", + "user_agent", + "_document_id", + "actor_id", + "@timestamp", + "actor", + "visibility", + "operation_type", + "repo_id", + "programmatic_access_type" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "actor_id", + "repo_id", + "_document_id", + "user_agent", + "actor", + "visibility", + "user_id", + "repo", + "@timestamp", + "operation_type", + "action", + "created_at", + "programmatic_access_type" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "user_agent", + "user_id", + "created_at", + "visibility", + "actor", + "actor_id", + "user", + "operation_type", + "repo_id", + "action", + "repo", + "_document_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "repo.pages_soft_delete", "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.pages_soft_delete_restore", "description": "A GitHub Pages site that was previously soft-deleted was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "actor_id", + "operation_type", + "user_agent", + "actor", + "@timestamp", + "repo_id", + "user", + "_document_id", + "visibility", + "repo", + "created_at", + "action", + "programmatic_access_type" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "actor_id", + "repo", + "operation_type", + "action", + "@timestamp", + "actor", + "user_agent", + "created_at", + "_document_id", + "repo_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "integration", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "user", + "business", + "action", + "actor_id", + "org", + "org_id", + "actor", + "created_at", + "repo_id", + "user_agent", + "business_id", + "user_id", + "operation_type", + "@timestamp", + "_document_id", + "visibility", + "repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "actor_id", + "repo_id", + "@timestamp", + "_document_id", + "repo", + "org_id", + "action", + "operation_type", + "user_agent", + "actor", + "created_at", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "action", + "repo_id", + "user_agent", + "topic", + "operation_type", + "user_id", + "org", + "org_id", + "actor", + "business", + "repo", + "@timestamp", + "created_at", + "_document_id", + "actor_id", + "business_id", + "programmatic_access_type" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "user_agent", + "@timestamp", + "actor_id", + "actor", + "old_name", + "repo", + "user_id", + "created_at", + "user", + "action", + "operation_type", + "visibility", + "repo_id", + "_document_id", + "programmatic_access_type" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "action", + "_document_id", + "actor_id", + "user", + "operation_type", + "user_agent", + "repo_id", + "@timestamp", + "created_at", + "actor", + "user_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "policy", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "policy", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "limit", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "repo", + "repo_id", + "public_repo", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "policy", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "repo", + "repo_id", + "public_repo", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "created_at", + "actor", + "repo_id", + "action", + "org", + "org_id", + "repo", + "operation_type" + ] }, { "action": "repo.temporary_access_granted", "description": "Temporary access was enabled for a repository.", - "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "user_id", + "_document_id", + "actor_id", + "repo_id", + "owner", + "user", + "old_user", + "action", + "operation_type", + "created_at", + "user_agent", + "repo", + "visibility", + "repo_was", + "actor" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "visibility", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "operation_type", + "user_id", + "user", + "action", + "user_agent", + "created_at", + "actor", + "visibility", + "repo_id", + "actor_id", + "repo" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "actor", + "actor_id", + "repo", + "operation_type", + "created_at", + "_document_id", + "repo_id", + "user", + "@timestamp", + "visibility", + "user_agent", + "user_id", + "action", + "programmatic_access_type" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "policy", + "old_policy", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "new_policy", + "old_policy", + "updated_access_policy", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "visibility", + "integration", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "action", + "_document_id", + "actor", + "repo_id", + "created_at", + "oauth_application_id", + "user", + "@timestamp", + "repo", + "operation_type", + "org_id", + "actor_id", + "visibility", + "old_permission", + "org", + "user_id", + "old_base_role", + "old_repo_permission", + "old_repo_base_role", + "new_repo_base_role", + "new_repo_permission", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "operation_type", + "created_at", + "actor_id", + "repo_id", + "action", + "actor", + "content_type", + "repo", + "@timestamp", + "_document_id", + "user", + "user_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "content_type", + "created_at", + "actor_id", + "user_id", + "operation_type", + "_document_id", + "actor", + "repo_id", + "user_agent", + "repo", + "user", + "action", + "@timestamp" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "created_at", + "repo", + "invitee", + "operation_type", + "actor", + "repo_id", + "_document_id", + "action", + "user_agent", + "inviter", + "@timestamp", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "inviter", + "action", + "operation_type", + "_document_id", + "repo_id", + "repo", + "@timestamp", + "user_agent", + "invitee", + "created_at", + "actor", + "actor_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "actor", + "actor_id", + "@timestamp", + "invitee", + "action", + "inviter", + "repo", + "created_at", + "user_agent", + "repo_id", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "_document_id", + "actor", + "invitee", + "action", + "@timestamp", + "actor_id", + "operation_type", + "created_at", + "inviter", + "user_agent", + "repo_id" + ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "ruleset_id", + "ruleset_name", + "ruleset_enforcement", + "ruleset_source_type", + "ruleset_rules", + "ruleset_conditions", + "ruleset_bypass_actors" + ] }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", + "fields": [ + "actor", + "actor_id", + "user_agent", + "old_name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "ruleset_id", + "ruleset_name", + "ruleset_enforcement", + "ruleset_source_type", + "ruleset_rules_updated", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_old_enforcement", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_old_name", + "ruleset_conditions_updated", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "actor_is_bot" + ] }, { "action": "security_key.register", "description": "A security key was registered for an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user", + "created_at", + "user_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "user_agent" + ] }, { "action": "security_key.remove", "description": "A security key was removed from an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "user_id", + "operation_type", + "_document_id", + "user_agent", + "@timestamp", + "actor_id", + "action", + "created_at", + "user" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "action", + "created_at", + "_document_id", + "actor", + "user_agent", + "actor_id", + "operation_type" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "operation_type", + "_document_id", + "created_at", + "actor", + "user", + "action", + "actor_id", + "user_id", + "@timestamp" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "actor", + "user_id", + "action", + "@timestamp", + "user_agent", + "user", + "operation_type", + "created_at", + "actor_id", + "_document_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "active", + "user", + "user_id", + "actor", + "actor_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "actor_id", + "action", + "@timestamp", + "user_id", + "created_at", + "user", + "_document_id", + "user_agent", + "actor", + "operation_type" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "user_id", + "actor", + "actor_id", + "action", + "user", + "operation_type", + "@timestamp", + "_document_id", + "created_at" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "user_id", + "action", + "user_agent", + "actor", + "user", + "operation_type", + "@timestamp", + "created_at", + "actor_id", + "_document_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "user_id", + "operation_type", + "actor_id", + "@timestamp", + "_document_id", + "user", + "action", + "created_at", + "user_agent", + "actor" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "actor_id", + "operation_type", + "created_at", + "user_agent", + "actor", + "action", + "_document_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "created_at", + "user", + "action", + "user_agent", + "operation_type", + "_document_id", + "actor", + "actor_id", + "user_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "user_agent", + "user", + "@timestamp", + "actor_id", + "user_id", + "_document_id", + "actor", + "action", + "operation_type", + "created_at" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "operation_type", + "actor", + "user_id", + "action", + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "user", + "created_at" + ] }, { "action": "sponsors.sponsored_developer_update_newsletter_send", "description": "Triggered when you send an email update to your sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", + "fields": [ + "actor", + "action", + "user_agent", + "operation_type", + "_document_id", + "created_at", + "actor_id", + "user", + "user_id", + "@timestamp" + ] }, { "action": "sponsors.sponsors_patreon_user_create", "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", + "fields": [ + "actor", + "actor_id", + "user_agent", + "patreon_email", + "patreon_username", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.sponsors_patreon_user_destroy", "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", + "fields": [ + "actor", + "actor_id", + "user_agent", + "patreon_email", + "patreon_username", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.waitlist_join", "description": "You join the waitlist to join GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "actor", + "user_id", + "user_agent", + "actor_id", + "action", + "operation_type", + "created_at", + "user", + "@timestamp", + "_document_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "successor_invitation.accept", "description": "Triggered when you accept a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "successor_invitation.cancel", "description": "Triggered when you cancel a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "successor_invitation.create", "description": "Triggered when you create a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "successor_invitation.decline", "description": "Triggered when you decline a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "successor_invitation.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "successor_invitation.revoke", "description": "Triggered when you revoke a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "trusted_device.register", "description": "A new trusted device was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "trusted_device.remove", "description": "A trusted device was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "two_factor_account_recovery.abort", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "action", + "user_id", + "@timestamp", + "_document_id", + "user", + "user_agent", + "operation_type" + ] }, { "action": "two_factor_account_recovery.complete", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "created_at", + "user_id", + "operation_type", + "user", + "_document_id", + "user_agent", + "action" + ] }, { "action": "two_factor_account_recovery.ignore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "created_at", + "user_id", + "operation_type", + "@timestamp", + "user", + "action" + ] }, { "action": "two_factor_account_recovery.staff_approve", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "actor", + "actor_id", + "@timestamp", + "user", + "user_id", + "user_agent", + "operation_type", + "action", + "_document_id" + ] }, { "action": "two_factor_account_recovery.staff_decline", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "actor", + "action", + "@timestamp", + "user_agent", + "operation_type", + "user", + "created_at", + "actor_id", + "_document_id" + ] }, { "action": "two_factor_account_recovery.start", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "operation_type", + "@timestamp", + "user_agent", + "created_at", + "user_id", + "action", + "_document_id" + ] }, { "action": "two_factor_account_recovery.two_factor_destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user_id", + "action", + "@timestamp", + "created_at", + "user_agent", + "user", + "_document_id" + ] }, { "action": "two_factor_authentication.add_factor", "description": "A secondary authentication factor was added to a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "two_factor_authentication.disabled", "description": "Two-factor authentication was disabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", + "fields": [ + "actor", + "action", + "_document_id", + "user_agent", + "user", + "user_id", + "actor_id", + "created_at", + "operation_type", + "@timestamp" + ] }, { "action": "two_factor_authentication.enabled", "description": "Two-factor authentication was enabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "actor", + "operation_type", + "user_agent", + "action", + "created_at", + "actor_id", + "@timestamp", + "user", + "user_id", + "_document_id" + ] }, { "action": "two_factor_authentication.password_reset_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "created_at", + "user", + "user_id", + "action", + "@timestamp", + "_document_id", + "user_agent" + ] }, { "action": "two_factor_authentication.recovery_codes_regenerated", "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "operation_type", + "_document_id", + "user_id", + "action", + "user", + "user_agent", + "actor_id", + "@timestamp", + "created_at" + ] }, { "action": "two_factor_authentication.remove_factor", "description": "A secondary authentication factor was removed from a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "two_factor_authentication.sign_in_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user_id", + "user", + "user_agent", + "created_at", + "_document_id", + "action", + "@timestamp" + ] }, { "action": "two_factor_authentication.update_fallback", "description": "The two-factor authentication fallback for a user account was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "created_at", + "_document_id", + "user", + "user_id", + "operation_type", + "user_agent", + "action", + "actor", + "actor_id" + ] }, { "action": "user.add_email", "description": "An email address was added to a user account.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", + "fields": [ + "action", + "user", + "user_id", + "user_agent", + "operation_type", + "_document_id", + "actor_id", + "actor", + "email", + "@timestamp", + "created_at" + ] }, { "action": "user.async_delete", "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "user_id", + "created_at", + "user", + "@timestamp", + "_document_id", + "actor_id", + "operation_type", + "user_agent", + "action" + ] }, { "action": "user.audit_log_export", "description": "Audit log entries were exported.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user", + "action", + "actor", + "@timestamp", + "_document_id", + "user_agent", + "user_id", + "operation_type", + "created_at" + ] }, { "action": "user.block_user", "description": "A user was blocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "actor", + "user_id", + "_document_id", + "actor_id", + "@timestamp", + "user_agent", + "user", + "blocked_user", + "operation_type", + "created_at", + "programmatic_access_type" + ] }, { "action": "user.change_password", "description": "A user changed their password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "user_agent", + "actor_id", + "operation_type", + "actor", + "user", + "user_id", + "action", + "created_at", + "_document_id" + ] }, { "action": "user.codespaces_trusted_repo_access_granted", "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "user.codespaces_trusted_repo_access_revoked", "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "user.create", "description": "A new user account was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "email", + "user_id", + "operation_type", + "@timestamp", + "user", + "created_at", + "_document_id", + "user_agent", + "actor", + "actor_id", + "action", + "programmatic_access_type" + ] }, { "action": "user.create_integration_secret", "description": "A user secret for Codespaces was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "integration", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "user.creation_rate_limit_exceeded", "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "created_at", + "user_agent", + "_document_id", + "operation_type", + "oauth_application_id", + "action", + "actor", + "actor_id", + "user_id", + "@timestamp", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "user.delete", "description": "A user account was destroyed by an asynchronous job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "created_at", + "user_agent", + "action", + "user_id", + "actor", + "actor_id", + "user", + "@timestamp", + "_document_id" + ] }, { "action": "user.demote", "description": "A site administrator was demoted to an ordinary user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "oauth_application_id", + "action", + "user", + "created_at", + "user_agent", + "actor", + "actor_id", + "operation_type", + "_document_id", + "user_id", + "programmatic_access_type" + ] }, { "action": "user.destroy", "description": "A user deleted his or her account, triggering user.async_delete.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "user", + "_document_id", + "created_at", + "user_agent", + "user_id", + "operation_type", + "actor_id", + "action", + "@timestamp" + ] }, { "action": "user.device_verification_failure", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "created_at", + "_document_id", + "@timestamp", + "user", + "user_agent", + "user_id", + "actor_id", + "action", + "operation_type" + ] }, { "action": "user.device_verification_requested", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "user_id", + "actor", + "operation_type", + "created_at", + "_document_id", + "@timestamp", + "user", + "actor_id", + "action" + ] }, { "action": "user.device_verification_success", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "user", + "_document_id", + "action", + "operation_type", + "user_agent", + "created_at", + "actor", + "actor_id", + "user_id" + ] }, { "action": "user.disable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "user.disable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "user.disable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "user.enable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "user.enable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "user.enable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "user.failed_login", "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "action", + "operation_type", + "created_at", + "_document_id", + "@timestamp", + "user", + "org_id", + "actor", + "actor_id", + "user_agent" + ] }, { "action": "user.forgot_password", "description": "A user requested a password reset.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", + "fields": [ + "action", + "_document_id", + "user_agent", + "user", + "operation_type", + "@timestamp", + "email", + "created_at", + "user_id" + ] }, { "action": "user.grant_github_developer", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "action", + "created_at", + "user_agent", + "@timestamp", + "_document_id", + "user", + "user_id", + "actor", + "operation_type" + ] }, { "action": "user.hide_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "user.login", "description": "A user signed in.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "user_id", + "actor_id", + "@timestamp", + "user", + "action", + "operation_type", + "_document_id", + "created_at", + "actor" + ] }, { "action": "user.logout", "description": "A user signed out.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "user.new_device_used", "description": "A user signed in from a new device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "user_id", + "actor", + "operation_type", + "created_at", + "user_agent", + "actor_id", + "action", + "@timestamp", + "_document_id" + ] }, { "action": "user.promote", "description": "An ordinary user account was promoted to a site administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "action", + "actor", + "actor_id", + "user", + "@timestamp", + "created_at", + "user_agent", + "oauth_application_id", + "operation_type", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "user.recreate", "description": "A user's account was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "user", + "action", + "actor_id", + "@timestamp", + "_document_id", + "user_id", + "created_at", + "actor", + "operation_type" + ] }, { "action": "user.remove_email", "description": "An email address was removed from a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "action", + "@timestamp", + "_document_id", + "user", + "user_id", + "operation_type", + "actor", + "actor_id", + "created_at", + "email", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "user.remove_integration_secret", "description": "A user secret for Codespaces was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "integration", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "user.rename", "description": "A username was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "action", + "actor_id", + "old_login", + "created_at", + "_document_id", + "actor", + "user_id", + "@timestamp", + "operation_type", + "user_agent", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "user.reset_password", "description": "A user reset their account password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "action", + "user_agent", + "user", + "user_id", + "created_at", + "@timestamp", + "_document_id", + "actor", + "operation_type" + ] }, { "action": "user_session.country_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "user_id", + "action", + "@timestamp", + "_document_id", + "actor", + "actor_id", + "user", + "user_agent", + "operation_type" + ] }, { "action": "user.show_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "user_id", + "action", + "actor", + "user", + "operation_type", + "user_agent", + "actor_id", + "created_at" + ] }, { "action": "user.sign_in_from_unrecognized_device", "description": "A user signed in from an unrecognized device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "_document_id", + "user_agent", + "user", + "user_id", + "operation_type", + "created_at", + "actor", + "actor_id", + "@timestamp" + ] }, { "action": "user.sign_in_from_unrecognized_device_and_location", "description": "A user signed in from an unrecognized device and location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user", + "user_id", + "@timestamp", + "user_agent", + "created_at", + "_document_id", + "action", + "operation_type" + ] }, { "action": "user_status.destroy", "description": "Triggered when you clear the status on your profile.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "user_id", + "actor", + "message", + "user", + "actor_id", + "created_at", + "limited_availability", + "action", + "emoji", + "operation_type", + "user_agent", + "@timestamp", + "_document_id" + ] }, { "action": "user_status.update", "description": "Triggered when you set or change the status on your profile.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", + "fields": [ + "limited_availability", + "user", + "action", + "actor_id", + "message", + "user_id", + "created_at", + "_document_id", + "@timestamp", + "user_agent", + "emoji", + "org", + "actor", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "user.suspend", "description": "A user account was suspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "oauth_application_id", + "operation_type", + "actor_id", + "user", + "user_agent", + "actor", + "created_at", + "_document_id", + "@timestamp", + "user_id", + "action", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "user.toggle_warn_private_email", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "actor_id", + "@timestamp", + "operation_type", + "_document_id", + "user_agent", + "actor", + "action", + "user_id", + "created_at" + ] }, { "action": "user.two_factor_challenge_failure", "description": "A 2FA challenge issued for a user account failed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "created_at", + "_document_id", + "user_agent", + "user", + "actor_id", + "actor", + "user_id", + "@timestamp", + "action" + ] }, { "action": "user.two_factor_challenge_success", "description": "A 2FA challenge issued for a user account succeeded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "user_id", + "operation_type", + "actor_id", + "user", + "actor", + "user_agent", + "action", + "created_at" + ] }, { "action": "user.two_factor_recover", "description": "A user used their 2FA recovery codes.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "operation_type", + "user_agent", + "user", + "action", + "actor", + "actor_id", + "created_at", + "@timestamp", + "_document_id" + ] }, { "action": "user.two_factor_recovery_codes_downloaded", "description": "A user downloaded 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "operation_type", + "actor_id", + "user", + "action", + "@timestamp", + "created_at", + "user_agent", + "actor", + "_document_id" + ] }, { "action": "user.two_factor_recovery_codes_printed", "description": "A user printed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "action", + "operation_type", + "user_agent", + "user_id", + "created_at", + "_document_id", + "actor", + "actor_id", + "@timestamp" + ] }, { "action": "user.two_factor_recovery_codes_viewed", "description": "A user viewed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user_agent", + "actor", + "user_id", + "action", + "created_at", + "user", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "user.two_factor_requested", "description": "A user was prompted for a two-factor authentication code.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", + "fields": [ + "user", + "actor_id", + "action", + "user_agent", + "created_at", + "_document_id", + "user_id", + "operation_type", + "@timestamp", + "actor" + ] }, { "action": "user.unblock_user", "description": "A user was unblocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "action", + "_document_id", + "blocked_user", + "operation_type", + "actor", + "@timestamp", + "user_agent", + "user_id", + "user", + "created_at" + ] }, { "action": "user.unsuspend", "description": "A user account was unsuspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "user", + "action", + "user_agent", + "actor", + "oauth_application_id", + "operation_type", + "actor_id", + "created_at", + "@timestamp", + "user_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "user.update_integration_secret", "description": "A user secret for Codespaces was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "integration", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "user.update_new_repository_default_branch_setting", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "user_agent", + "actor", + "actor_id", + "workflow_run_id", + "run_number", + "user", + "user_id", + "repo", + "repo_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "workflow_run_id", + "run_number", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "token_id", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "workflow_run_id", + "run_number", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "workflow_run_id", + "started_at", + "head_branch", + "head_sha", + "trigger_id", + "programmatic_access_type" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "workflow_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "workflow_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "user_agent", + "actor", + "actor_id", + "workflow_run_id", + "run_number", + "user", + "user_id", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghec/enterprise.json b/src/audit-logs/data/ghec/enterprise.json index 07fbd0c2dfab..72fc050cfd31 100644 --- a/src/audit-logs/data/ghec/enterprise.json +++ b/src/audit-logs/data/ghec/enterprise.json @@ -2,3896 +2,15738 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "@timestamp", + "operation_type", + "user_agent", + "_document_id", + "created_at", + "action", + "actor", + "actor_id", + "org_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "actor", + "operation_type", + "_document_id", + "user_agent", + "created_at", + "actor_id", + "@timestamp", + "user", + "action", + "user_id", + "programmatic_access_type" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "user_id", + "user", + "repo_id", + "repo", + "org", + "org_id", + "actions_cache_id", + "actions_cache_key", + "actions_cache_version", + "actions_cache_scope", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "advisory_credit.accept", "description": "Credit was accepted for a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", + "fields": [ + "user_agent", + "actor", + "actor_id", + "ghsa_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "advisory_credit.create", "description": "Someone was added to the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "ghsa_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "advisory_credit.decline", "description": "Credit was declined for a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "ghsa_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "advisory_credit.destroy", "description": "Someone was removed from the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "ghsa_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "api.request", "description": "An API request was made to a security-significant endpoint for the enterprise. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests", + "fields": [ + "user_agent", + "request_method", + "query_string", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "request_body", + "status_code", + "url_path", + "business", + "business_id", + "org", + "org_id", + "repo", + "repo_id", + "public_repo", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "route", + "rate_limit_remaining", + "actor_is_bot" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "actor", + "user_agent", + "actor_id", + "repo", + "repo_id", + "@timestamp", + "created_at", + "_document_id", + "operation_type", + "programmatic_access_type" + ] }, { "action": "audit_log_streaming.check", "description": "A manual check of the endpoint configured for audit log streaming was performed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "business_id", + "business", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "audit_log_streaming.create", "description": "An endpoint was added for audit log streaming.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "business_id", + "business", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "audit_log_streaming.destroy", "description": "An audit log streaming endpoint was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "business_id", + "business", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "audit_log_streaming.update", "description": "An endpoint configuration was updated for audit log streaming, such as the stream was paused, enabled, or disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "business_id", + "business", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "auto_approve_personal_access_token_requests.disable", "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "auto_approve_personal_access_token_requests.enable", "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "actor_id", + "user", + "@timestamp", + "actor", + "user_id", + "action", + "created_at", + "operation_type", + "_document_id", + "user_agent" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "actor", + "operation_type", + "actor_id", + "org_id", + "@timestamp", + "user_agent", + "created_at", + "_document_id", + "org", + "email", + "action" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "oauth_application_id", + "@timestamp", + "actor_id", + "operation_type", + "_document_id", + "actor", + "user", + "user_id", + "user_agent", + "created_at", + "action" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user", + "operation_type", + "user_agent", + "created_at", + "user_id", + "actor", + "action", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "billing.update_bill_cycle_day", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.add_admin", "description": "An enterprise owner was added to an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", + "fields": [ + "name", + "business", + "user", + "user_id", + "@timestamp", + "created_at", + "actor", + "actor_id", + "action", + "operation_type", + "business_id", + "_document_id", + "user_agent", + "programmatic_access_type" + ] }, { "action": "business.add_billing_manager", "description": "A billing manager was added to an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "user", + "actor", + "name", + "business", + "business_id", + "action", + "@timestamp", + "actor_id", + "operation_type", + "created_at", + "user_id", + "_document_id" + ] }, { "action": "business.add_organization", "description": "An organization was added to an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "operation_type", + "@timestamp", + "actor", + "business_id", + "org", + "action", + "user_agent", + "actor_id", + "name", + "created_at", + "_document_id", + "business", + "organization_upgrade" + ] }, { "action": "business.add_support_entitlee", "description": "A support entitlement was added to a member of an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/managing-support-entitlements-for-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/managing-support-entitlements-for-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "business", + "business_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "business_advanced_security.disabled", "description": "GitHub Advanced Security was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_advanced_security.disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_advanced_security.disabled_for_new_user_namespace_repos", "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "business_advanced_security.enabled", "description": "GitHub Advanced Security was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_advanced_security.enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_advanced_security.enabled_for_new_user_namespace_repos", "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "business.advanced_security_policy_update", "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "new_policy", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "business.advanced_security_repo_admin_enablement_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "new_policy", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_advanced_security.user_namespace_repos_disabled", "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "business_advanced_security.user_namespace_repos_enabled", "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "business.audit_log_export", "description": "An export of the enterprise audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", - "docs_reference_links": "admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/exporting-audit-log-activity-for-your-enterprise" + "docs_reference_links": "admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/exporting-audit-log-activity-for-your-enterprise", + "fields": [ + "user_agent", + "business", + "business_id", + "@timestamp", + "actor_id", + "operation_type", + "created_at", + "actor", + "action", + "_document_id", + "query_phrase" + ] }, { "action": "business.audit_log_git_event_export", "description": "An export of the enterprise's Git events was created.", - "docs_reference_links": "admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/exporting-audit-log-activity-for-your-enterprise" + "docs_reference_links": "admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/exporting-audit-log-activity-for-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "start", + "end", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "business.cancel_admin_invitation", "description": "An invitation for someone to be an owner of an enterprise was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "actor_id", + "user_agent", + "user_id", + "_document_id", + "operation_type", + "created_at", + "name", + "actor", + "@timestamp", + "business", + "business_id", + "action" + ] }, { "action": "business.cancel_billing_manager_invitation", "description": "An invitation for someone to be an billing manager of an enterprise was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "business_id", + "action", + "@timestamp", + "actor", + "name", + "_document_id", + "actor_id", + "created_at", + "business", + "user_id", + "operation_type", + "user_agent", + "user" + ] }, { "action": "business.cancel_trial", "description": "The trial of GitHub Enterprise Cloud was cancelled.", - "docs_reference_links": "/admin/overview/setting-up-a-trial-of-github-enterprise-cloud" + "docs_reference_links": "/admin/overview/setting-up-a-trial-of-github-enterprise-cloud", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.clear_actions_settings", "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "business.clear_default_repository_permission", "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", + "fields": [ + "name", + "operation_type", + "business_id", + "user_agent", + "actor_id", + "actor", + "_document_id", + "business", + "action", + "@timestamp", + "created_at" + ] }, { "action": "business.clear_members_can_create_repos", "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation", + "fields": [ + "user_agent", + "actor_id", + "business_id", + "action", + "_document_id", + "name", + "business", + "visibility", + "created_at", + "actor", + "operation_type", + "@timestamp" + ] }, { "action": "business.connect_usage_metrics_export", "description": "Server statistics were exported for the enterprise.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.convert_trial", "description": "The enterprise account on a trial of GitHub Enterprise Cloud was upgraded to a paid enterprise account.", - "docs_reference_links": "/admin/overview/setting-up-a-trial-of-github-enterprise-cloud" + "docs_reference_links": "/admin/overview/setting-up-a-trial-of-github-enterprise-cloud", + "fields": [ + "name", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.create", "description": "An enterprise was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "_document_id", + "action", + "@timestamp", + "name", + "business", + "business_id", + "operation_type", + "actor", + "created_at", + "user_agent" + ] }, { "action": "business.create_trial", "description": "A trial of GitHub Enterprise Cloud began.", - "docs_reference_links": "/admin/overview/setting-up-a-trial-of-github-enterprise-cloud" + "docs_reference_links": "/admin/overview/setting-up-a-trial-of-github-enterprise-cloud", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.delete", "description": "The enterprise was deleted.", - "docs_reference_links": "/admin/overview/deleting-an-enterprise-account" + "docs_reference_links": "/admin/overview/deleting-an-enterprise-account", + "fields": [ + "actor_id", + "business", + "action", + "business_id", + "@timestamp", + "operation_type", + "_document_id", + "user_agent", + "actor", + "name", + "created_at" + ] }, { "action": "business_dependabot_alerts.disable", "description": "Dependabot alerts were disabled for your enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_dependabot_alerts.enable", "description": "Dependabot alerts were enabled for your enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for new repositories in your enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for new repositories in your enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.dependabot_alerts_repo_admin_enablement_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "new_policy", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.disable_oidc", "description": "OIDC single sign-on was disabled for an enterprise.", - "docs_reference_links": "/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/configuring-oidc-for-enterprise-managed-users" + "docs_reference_links": "/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/configuring-oidc-for-enterprise-managed-users", + "fields": [ + "actor", + "actor_id", + "user_agent", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.disable_open_scim", "description": "SCIM provisioning for custom integrations that use the REST API was disabled for the enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.disable_saml", "description": "SAML single sign-on was disabled for an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "business", + "action", + "created_at", + "actor", + "user_agent", + "business_id", + "operation_type", + "_document_id", + "issuer", + "@timestamp", + "actor_id", + "name", + "sso_url" + ] }, { "action": "business.disable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the enterprise was disabled.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.disable_two_factor_requirement", "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "@timestamp", + "actor", + "business", + "operation_type", + "created_at", + "user_agent", + "business_id", + "actor_id", + "name", + "_document_id" + ] }, { "action": "business.enable_oidc", "description": "OIDC single sign-on was enabled for an enterprise.", - "docs_reference_links": "/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/configuring-oidc-for-enterprise-managed-users" + "docs_reference_links": "/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/configuring-oidc-for-enterprise-managed-users", + "fields": [ + "actor", + "actor_id", + "user_agent", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.enable_open_scim", "description": "SCIM provisioning for custom integrations that use the REST API was enabled for the enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.enable_saml", "description": "SAML single sign-on was enabled for an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "name", + "sso_url", + "@timestamp", + "issuer", + "action", + "actor_id", + "_document_id", + "created_at", + "actor", + "business_id", + "business", + "user_agent" + ] }, { "action": "business.enable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the enterprise was enabled.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.enable_two_factor_requirement", "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "action", + "user_agent", + "actor", + "operation_type", + "created_at", + "business", + "business_id", + "name", + "_document_id", + "@timestamp" + ] }, { "action": "business.enterprise_server_license_download", "description": "A GitHub Enterprise Server license was downloaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "business", + "user_agent", + "action", + "user", + "business_id", + "_document_id", + "actor_id", + "operation_type", + "created_at", + "user_id", + "@timestamp" + ] }, { "action": "business.expire_trial", "description": "The trial of GitHub Enterprise Cloud expired.", - "docs_reference_links": "/admin/overview/setting-up-a-trial-of-github-enterprise-cloud" + "docs_reference_links": "/admin/overview/setting-up-a-trial-of-github-enterprise-cloud", + "fields": [ + "name", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.import_license_usage", "description": "License usage information was imported from a GitHub Enterprise Server instance to an enterprise account on GitHub.com.", - "docs_reference_links": "/billing/managing-your-license-for-github-enterprise/syncing-license-usage-between-github-enterprise-server-and-github-enterprise-cloud#manually-uploading-github-enterprise-server-license-usage" + "docs_reference_links": "/billing/managing-your-license-for-github-enterprise/syncing-license-usage-between-github-enterprise-server-and-github-enterprise-cloud#manually-uploading-github-enterprise-server-license-usage", + "fields": [ + "name", + "actor", + "business_id", + "created_at", + "user_agent", + "operation_type", + "business", + "action", + "@timestamp", + "_document_id", + "actor_id" + ] }, { "action": "business.invite_admin", "description": "An invitation for someone to be an enterprise owner of an enterprise was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "name", + "business", + "business_id", + "user_id", + "user_agent", + "actor", + "actor_id", + "_document_id", + "@timestamp", + "user", + "operation_type", + "created_at" + ] }, { "action": "business.invite_billing_manager", "description": "An invitation for someone to be an billing manager of an enterprise was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "operation_type", + "user_agent", + "_document_id", + "business", + "actor", + "user_id", + "action", + "@timestamp", + "name", + "actor_id", + "business_id", + "created_at" + ] }, { "action": "business.members_can_update_protected_branches.clear", "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "action", + "created_at", + "actor", + "actor_id", + "@timestamp", + "business", + "name", + "operation_type", + "user", + "user_agent", + "business_id", + "_document_id" + ] }, { "action": "business.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "business", + "business_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "business.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "name", + "actor", + "operation_type", + "_document_id", + "business_id", + "user", + "@timestamp", + "business", + "actor_id", + "created_at", + "action", + "user_agent", + "user_id" + ] }, { "action": "business.recovery_code_failed", "description": "An enterprise owner failed to sign into a enterprise with an external identity provider (IdP) using a recovery code.", - "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/accessing-your-enterprise-account-if-your-identity-provider-is-unavailable" + "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/accessing-your-enterprise-account-if-your-identity-provider-is-unavailable", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "reason", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.recovery_code_used", "description": "An enterprise owner successfully signed into an enterprise with an external identity provider (IdP) using a recovery code.", - "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/accessing-your-enterprise-account-if-your-identity-provider-is-unavailable" + "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/accessing-your-enterprise-account-if-your-identity-provider-is-unavailable", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.recovery_codes_downloaded", "description": "An enterprise owner downloaded the enterprise's SSO recovery codes.", - "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes" + "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.recovery_codes_generated", "description": "An enterprise owner generated the enterprise's SSO recovery codes.", - "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes" + "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.recovery_codes_printed", "description": "An enterprise owner printed the enterprise's SSO recovery codes.", - "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes" + "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.recovery_codes_viewed", "description": "An enterprise owner viewed the enterprise's SSO recovery codes.", - "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes" + "docs_reference_links": "/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.remove_admin", "description": "An enterprise owner was removed from an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", + "fields": [ + "actor", + "operation_type", + "user_agent", + "business", + "business_id", + "@timestamp", + "created_at", + "action", + "name", + "actor_id", + "user_id", + "_document_id", + "user" + ] }, { "action": "business.remove_billing_manager", "description": "A billing manager was removed from an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "business", + "actor", + "user_id", + "user_agent", + "action", + "_document_id", + "operation_type", + "@timestamp", + "name", + "business_id", + "user", + "created_at" + ] }, { "action": "business.remove_member", "description": "A member was removed from an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "@timestamp", + "business_id", + "actor_id", + "actor", + "operation_type", + "user", + "created_at", + "business", + "user_id", + "action", + "_document_id" + ] }, { "action": "business.remove_organization", "description": "An organization was removed from an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "action", + "business", + "actor", + "actor_id", + "created_at", + "user_agent", + "business_id", + "operation_type", + "@timestamp", + "_document_id", + "name", + "org" + ] }, { "action": "business.remove_support_entitlee", "description": "A support entitlement was removed from a member of an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/managing-support-entitlements-for-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/managing-support-entitlements-for-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "business", + "business_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "business.rename_slug", "description": "The slug for the enterprise URL was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "name", + "business_id", + "user_agent", + "action", + "actor_id", + "operation_type", + "actor", + "@timestamp", + "created_at", + "business", + "_document_id" + ] }, { "action": "business.restore", "description": "The deleted enterprise was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.revoke_external_identity", "description": "The external identity for a member in an enterprise was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "user_id", + "operation_type", + "actor", + "created_at", + "name", + "user_agent", + "actor_id", + "business_id", + "action", + "user", + "business" + ] }, { "action": "business.revoke_sso_session", "description": "The SAML single sign-on session for a member in an enterprise was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "business_id", + "user_agent", + "user", + "operation_type", + "actor", + "_document_id", + "actor_id", + "name", + "@timestamp", + "user_id", + "action", + "created_at", + "business" + ] }, { "action": "business_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the business level", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the business level", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning_custom_pattern.create", "description": "An enterprise-level custom pattern was created for secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning_custom_pattern.delete", "description": "An enterprise-level custom pattern was removed from secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning_custom_pattern.publish", "description": "An enterprise-level custom pattern was published for secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning_custom_pattern.update", "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning.disable", "description": "Secret scanning was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning.disabled_for_new_repos", "description": "Secret scanning was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning.enable", "description": "Secret scanning was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning.enabled_for_new_repos", "description": "Secret scanning was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.disable", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.enable", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.update", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning_push_protection.disable", "description": "Push protection for secret scanning was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning_push_protection.disabled_for_new_repos", "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning_push_protection.enable", "description": "Push protection for secret scanning was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business_secret_scanning_push_protection.enabled_for_new_repos", "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.secret_scanning_repo_admin_settings_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "new_policy", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.set_actions_fork_pr_approvals_policy", "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "policy", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "policy", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "limit", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "business.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "policy", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "business.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "issuer", + "name", + "user_agent", + "action", + "@timestamp", + "_document_id", + "actor", + "business", + "business_id", + "actor_id", + "created_at", + "operation_type" + ] }, { "action": "business.update_actions_settings", "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "updated_github_owned_allowed", + "updated_verified_allowed", + "updated_patterns", + "new_policy", + "old_policy", + "updated_access_policy" + ] }, { "action": "business.update_default_repository_permission", "description": "The base repository permission setting was updated for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", + "fields": [ + "business_id", + "operation_type", + "user_agent", + "actor", + "actor_id", + "permission", + "action", + "created_at", + "@timestamp", + "name", + "_document_id", + "old_permission", + "business" + ] }, { "action": "business.update_emu_repo_self_hosted_runners_policy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "old_emu_repo_runners_policy", + "new_emu_repo_runners_policy", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.update_member_repository_creation_permission", "description": "The repository creation setting was updated for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation", + "fields": [ + "created_at", + "_document_id", + "name", + "business_id", + "actor", + "actor_id", + "@timestamp", + "operation_type", + "permission", + "action", + "business", + "user_agent", + "visibility" + ] }, { "action": "business.update_member_repository_invitation_permission", "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories", + "fields": [ + "business_id", + "created_at", + "action", + "operation_type", + "@timestamp", + "permission", + "actor", + "actor_id", + "name", + "_document_id", + "user_agent", + "business" + ] }, { "action": "business.update_repo_self_hosted_runners_policy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "old_repo_runners_policy", + "new_repo_runners_policy", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.update_saml_provider_settings", "description": "The SAML single sign-on provider settings for an enterprise were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "_document_id", + "business_id", + "sso_url", + "user_agent", + "action", + "business", + "name", + "created_at", + "operation_type", + "actor_id", + "@timestamp", + "issuer" + ] }, { "action": "business.upgrade_from_organization", "description": "The organization was upgraded to an enterprise account.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/upgrading-your-accounts-plan#upgrading-your-organizations-plan" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/upgrading-your-accounts-plan#upgrading-your-organizations-plan", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "visibility", + "user_agent", + "user", + "@timestamp", + "repo", + "actor_id", + "user_id", + "action", + "created_at", + "actor", + "operation_type", + "repo_id", + "_document_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "actor", + "actor_id", + "operation_type", + "repo_id", + "action", + "created_at", + "_document_id", + "user_agent", + "repo", + "programmatic_access_type" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "origin_repository", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.attempted_to_create_from_prebuild", "description": "An attempt to create a codespace from a prebuild was made.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "owner", + "pull_request_id", + "user_id", + "user", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "codespaces.business_enablement_updated", "description": "Enterprise setting for Codespaces ownership was updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "enablement", + "organization_names", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "user_id", + "org_id", + "owner", + "name", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot", + "machine_type", + "devcontainer_path" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "owner", + "name", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot", + "machine_type", + "devcontainer_path" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "owner", + "name", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "owner", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "codespaces.policy_group_created", "description": "Policies were applied to codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.policy_group_deleted", "description": "Policies were removed from codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "codespaces.policy_group_updated", "description": "Policies were updated for codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.start_environment", "description": "A codespace was started.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "org", + "owner", + "pull_request_id", + "machine_type", + "user_id", + "user", + "devcontainer_path", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "user_agent", + "actor", + "actor_id", + "business", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "commit_comment.destroy", "description": "A commit comment was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "repo", + "org", + "org_id", + "created_at", + "@timestamp", + "operation_type", + "repo_id", + "actor_id", + "_document_id", + "user_agent", + "action", + "programmatic_access_type" + ] }, { "action": "commit_comment.update", "description": "A commit comment was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "repo_id", + "actor", + "org", + "action", + "@timestamp", + "repo", + "org_id", + "actor_id", + "created_at", + "user_agent", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "copilot.access_revoked", "description": "The user's Copilot access was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "reason", + "plan", + "org_id", + "owner", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.cfb_enterprise_org_enablement_changed", "description": "The Copilot Business enablement policy changed at the enterprise level or for an organization within the enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "previous_value", + "current_value", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "copilot.cfb_enterprise_settings_changed", "description": "Settings for Copilot Business were changed at the enterprise level.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.cfb_org_settings_changed", "description": "Settings for Copilot Business were changed at the organization level.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.cfb_seat_added", "description": "A seat was added to the Copilot Business subscription for a user and they have received access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "token_id", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_assignment_created", "description": "A seat assignment was newly created for a user.", - "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business" + "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", + "fields": [ + "actor", + "actor_id", + "user_agent", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.cfb_seat_assignment_refreshed", "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_assignment_reused", "description": "A seat assignment was re-created for a user who already had a seat with no pending cancellation date.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.cfb_seat_assignment_unassigned", "description": "A seat was unassigned from a user and they will lose access to GitHub Copilot at the end of the billing cycle.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_cancelled", "description": "A seat was canceled from the Copilot Business subscription and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "seat_assignment" + ] }, { "action": "copilot.cfb_seat_cancelled_by_staff", "description": "A seat was canceled from the Copilot Business subscription manually by GitHub and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user_id", + "user", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_management_changed", "description": "The seat management setting was changed for the Copilot Business subscription.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "old_value", + "new_value", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "copilot.clickwrap_save_event", "description": "The GitHub Copilot Product Terms or Pre-Release Preview Terms were accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.content_exclusion_changed", "description": "The excluded paths for GitHub Copilot were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "excluded_paths", + "owner_type", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.enterprise_enablement_changed", "description": "The Copilot Business enablement policy changed at the enterprise level.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "previous_value", + "current_value", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.knowledge_base_created", "description": "A knowledge base was created in the organization.", - "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases" + "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases", + "fields": [ + "actor", + "actor_id", + "user_agent", + "knowledge_base_name", + "org_id", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "copilot.knowledge_base_deleted", "description": "A knowledge base was deleted from the organization.", - "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases" + "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases", + "fields": [ + "actor", + "actor_id", + "user_agent", + "knowledge_base_name", + "org_id", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "copilot.knowledge_base_updated", "description": "A knowledge base was updated in the organization.", - "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases" + "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases", + "fields": [ + "actor", + "actor_id", + "user_agent", + "knowledge_base_name", + "org_id", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "copilot.plan_changed", "description": "The plan for GitHub Copilot was updated.", - "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot" + "docs_reference_links": "/billing/managing-billing-for-github-copilot/about-billing-for-github-copilot", + "fields": [ + "actor", + "actor_id", + "user_agent", + "old_plan", + "plan", + "business_id", + "business", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "custom_property_definition.create", "description": "A new custom property definition was created.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "property_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "value_type", + "required", + "default_value", + "definition_id" + ] }, { "action": "custom_property_definition.destroy", "description": "A custom property definition was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "property_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "value_type", + "required", + "default_value", + "definition_id", + "allowed_values" + ] }, { "action": "custom_property_definition.update", "description": "A custom property definition was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "property_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "value_type", + "required", + "default_value", + "old_allowed_values", + "allowed_values", + "definition_id", + "old_required", + "old_default_value", + "old_value_type", + "old_values_editable_by", + "values_editable_by" + ] }, { "action": "custom_property_value.create", "description": "A repository's custom property value was manually set for the first time.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "definition_id", + "property_name", + "value", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "custom_property_value.destroy", "description": "A repository's custom property value was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "custom_property_value.update", "description": "A repository's custom property value was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "definition_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "discussion_comment.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "org", + "repo_id", + "action", + "actor", + "org_id", + "_document_id", + "actor_id", + "operation_type", + "@timestamp", + "created_at", + "user_agent", + "programmatic_access_type" + ] }, { "action": "discussion_comment.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "@timestamp", + "actor", + "user_agent", + "org", + "_document_id", + "actor_id", + "operation_type", + "created_at", + "repo", + "org_id", + "action" + ] }, { "action": "discussion.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "user_agent", + "actor_id", + "org_id", + "actor", + "org", + "action", + "operation_type", + "@timestamp", + "title", + "_document_id", + "created_at", + "repo", + "programmatic_access_type" + ] }, { "action": "discussion_post.destroy", "description": "Triggered when a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "team", + "created_at", + "user_id", + "@timestamp", + "number", + "org", + "title", + "actor", + "actor_id", + "user", + "action", + "user_agent", + "operation_type", + "_document_id" + ] }, { "action": "discussion_post_reply.destroy", "description": "Triggered when a reply to a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "actor_id", + "action", + "@timestamp", + "user_agent", + "operation_type", + "user_id", + "actor", + "number", + "user", + "created_at", + "_document_id" + ] }, { "action": "discussion_post_reply.update", "description": "Triggered when a reply to a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "action", + "_document_id", + "org", + "@timestamp", + "actor_id", + "operation_type", + "user", + "user_id", + "org_id", + "user_agent", + "actor", + "number", + "team", + "created_at" + ] }, { "action": "discussion_post.update", "description": "Triggered when a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "created_at", + "_document_id", + "title", + "user", + "user_agent", + "org", + "operation_type", + "actor_id", + "@timestamp", + "actor", + "team", + "action", + "org_id", + "user_id", + "number" + ] }, { "action": "enterprise_announcement.create", "description": "A global announcement banner was created for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", + "fields": [ + "actor", + "actor_id", + "user_agent", + "owner", + "owner_type", + "business_id", + "message", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "enterprise_announcement.destroy", "description": "A global announcement banner was removed from the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "owner", + "owner_type", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "enterprise_announcement.update", "description": "A global announcement banner was updated for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "owner", + "owner_type", + "business_id", + "message", + "old_message", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "enterprise.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "enterprise_domain.approve", "description": "A domain was approved for an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner_type", + "business_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "enterprise_domain.create", "description": "A domain was added to an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "owner_type", + "owner", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "enterprise_domain.destroy", "description": "A domain was removed from an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "owner_type", + "owner", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "enterprise_domain.verify", "description": "A domain was verified for an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner_type", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "enterprise_installation.create", "description": "The GitHub App associated with a GitHub Connect connection was created.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "created_at", + "operation_type", + "@timestamp", + "_document_id", + "org_id", + "action", + "org", + "actor_id", + "user_agent", + "actor" + ] }, { "action": "enterprise_installation.destroy", "description": "The GitHub App associated with a GitHub Connect connection was deleted.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "created_at", + "_document_id", + "action", + "@timestamp", + "actor_id", + "actor", + "user_agent", + "org", + "operation_type", + "org_id" + ] }, { "action": "enterprise.register_self_hosted_runner", "description": "A new GitHub Actions self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "enterprise.remove_self_hosted_runner", "description": "A GitHub Actions self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "enterprise.runner_group_created", "description": "A GitHub Actions self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "runner_group_restricted_to_workflows" + ] }, { "action": "enterprise.runner_group_removed", "description": "A GitHub Actions self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "enterprise.runner_group_renamed", "description": "A GitHub Actions self-hosted runner group was renamed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "enterprise.runner_group_runner_removed", "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "runner_group_id", + "runner_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "enterprise.runner_group_runners_added", "description": "A GitHub Actions self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "enterprise.runner_group_runners_updated", "description": "A GitHub Actions runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "runner_group_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "enterprise.runner_group_updated", "description": "The configuration of a GitHub Actions self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "runner_group_name", + "runner_group_allow_public", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs" + ] }, { "action": "enterprise.runner_group_visiblity_updated", "description": "The visibility of a GitHub Actions self-hosted runner group was updated via the REST API.", - "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "visibility", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "enterprise.self_hosted_runner_offline", "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "business_id", + "runner_id", + "runner_name", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp" + ] }, { "action": "enterprise.self_hosted_runner_online", "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "business_id", + "runner_id", + "runner_name", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp" + ] }, { "action": "enterprise.self_hosted_runner_updated", "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "business_id", + "runner_id", + "runner_name", + "source_version", + "target_version", + "runner_group_id", + "runner_group_name", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "environment_name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "environment_name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "public_repo", + "token_scopes" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "environment_name", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "environment_name", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "external_group.add_member", "description": "A user was added to an external group.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "external_group", + "external_group_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "external_group.delete", "description": "An external group was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes" + ] }, { "action": "external_group.link", "description": "An external group was linked to a GitHub team.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "external_group_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "external_group", + "programmatic_access_type" + ] }, { "action": "external_group.provision", "description": "An external group was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "external_group.remove_member", "description": "A user was removed from an external group.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "external_group", + "external_group_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "external_group.unlink", "description": "An external group was unlinked to a GitHub team.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "external_group_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "external_group" + ] }, { "action": "external_group.update", "description": "An external group was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "external_group.update_display_name", "description": "An external group's display name was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "external_group_id", + "external_group", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "external_identity.deprovision", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "action", + "user_id", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "external_identity.provision", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "action", + "user_id", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "external_identity.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "action", + "user_id", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "forbid_auto_approve_personal_access_token_requests.disable", "description": "Auto-approve policy for fine-grained personal access tokens was enabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization#enforcing-an-approval-policy-for-fine-grained-personal-access-tokens" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization#enforcing-an-approval-policy-for-fine-grained-personal-access-tokens", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "forbid_auto_approve_personal_access_token_requests.enable", "description": "Auto-approve policy for fine-grained personal access tokens was disabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization#enforcing-an-approval-policy-for-fine-grained-personal-access-tokens" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization#enforcing-an-approval-policy-for-fine-grained-personal-access-tokens", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "git.clone", "description": "A repository was cloned.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "transport_protocol", + "repository", + "repository_public", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "user", + "user_id", + "transport_protocol_name" + ] }, { "action": "git.fetch", "description": "Changes were fetched from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "transport_protocol", + "repository", + "repository_public", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "user", + "user_id", + "transport_protocol_name" + ] }, { "action": "git.push", "description": "Changes were pushed to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "transport_protocol", + "repository", + "repository_public", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "user", + "user_id", + "transport_protocol_name" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "runner_group_id", + "business", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "business", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "runner_group_id", + "business", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "name", + "events", + "active", + "active_was", + "hook_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "name", + "org", + "user_agent", + "hook_id", + "repo", + "repo_id", + "created_at", + "oauth_application_id", + "action", + "events", + "org_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "oauth_application", + "_document_id", + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "repo_id", + "hook_id", + "events", + "repo", + "@timestamp", + "operation_type", + "name", + "action", + "created_at", + "org_id", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "events", + "repo", + "created_at", + "org", + "name", + "actor_id", + "repo_id", + "org_id", + "action", + "operation_type", + "oauth_application_id", + "user_agent", + "hook_id", + "@timestamp", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "events", + "repo", + "operation_type", + "action", + "_document_id", + "actor_id", + "name", + "events_were", + "@timestamp", + "created_at", + "hook_id", + "repo_id", + "org_id", + "org", + "user_agent", + "oauth_application_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "action", + "operation_type", + "@timestamp", + "actor", + "user_agent", + "actor_id", + "name", + "user_id", + "_document_id", + "integration", + "created_at", + "programmatic_access_type" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "user_id", + "actor_id", + "@timestamp", + "name", + "integration", + "user", + "_document_id", + "action", + "operation_type", + "created_at", + "user_agent" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "operation_type", + "@timestamp", + "name", + "repository_selection", + "user_id", + "action", + "user_agent", + "user", + "created_at", + "integration", + "_document_id", + "programmatic_access_type" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "actor", + "created_at", + "_document_id", + "repository_selection", + "integration", + "user_id", + "user", + "action", + "operation_type", + "name", + "actor_id", + "user_agent", + "programmatic_access_type" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "user_id", + "repository_selection", + "name", + "user", + "integration", + "operation_type", + "actor_id", + "action", + "repositories_added", + "created_at", + "_document_id", + "@timestamp", + "actor", + "user_agent", + "token_scopes", + "repositories_added_names", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "user", + "operation_type", + "user_agent", + "actor", + "repository_selection", + "repositories_removed", + "integration", + "user_id", + "created_at", + "_document_id", + "@timestamp", + "name", + "action", + "actor_id", + "repositories_removed_names", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "integration_installation_request.close", "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "url", + "actor", + "actor_id", + "created_at", + "operation_type", + "@timestamp", + "integration", + "action", + "user_agent", + "reason", + "_document_id", + "org", + "org_id" + ] }, { "action": "integration_installation_request.create", "description": "A member requested that an owner install a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "@timestamp", + "actor_id", + "org", + "_document_id", + "action", + "user_agent", + "created_at", + "url", + "org_id", + "operation_type", + "actor", + "integration" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "user_agent", + "name", + "repository_selection", + "actor_id", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "user_agent", + "name", + "repository_selection", + "actor_id", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "integration", + "user_id", + "user_agent", + "name", + "user", + "operation_type", + "actor_id", + "action", + "_document_id", + "created_at", + "repository_selection", + "@timestamp", + "actor" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "created_at", + "action", + "_document_id", + "name", + "org_id", + "manager", + "operation_type", + "actor", + "integration", + "org", + "@timestamp", + "actor_id", + "user_agent" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "user_agent", + "actor_id", + "org", + "operation_type", + "integration", + "org_id", + "_document_id", + "action", + "actor", + "name", + "created_at", + "manager", + "@timestamp" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation" + "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "integration", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "user_id", + "name", + "user", + "action", + "actor_id", + "created_at", + "_document_id", + "user_agent", + "operation_type", + "actor", + "integration" + ] }, { "action": "integration.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation" + "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "integration", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "ip_allow_list.disable", "description": "An IP allow list was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "actor", + "org", + "user_agent", + "_document_id", + "user_id", + "actor_id", + "created_at", + "org_id", + "action", + "@timestamp", + "user" + ] }, { "action": "ip_allow_list.disable_for_installed_apps", "description": "An IP allow list was disabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "ip_allow_list.disable_skip_idp_ip_allowlist_app_access", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "ip_allow_list.disable_user_level_enforcement", "description": "IP allow list user level enforcement was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "ip_allow_list.enable", "description": "An IP allow list was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "business", + "user_id", + "actor", + "user", + "business_id", + "_document_id", + "action", + "@timestamp", + "user_agent", + "actor_id", + "operation_type", + "org", + "created_at" + ] }, { "action": "ip_allow_list.enable_for_installed_apps", "description": "An IP allow list was enabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "ip_allow_list.enable_skip_idp_ip_allowlist_app_access", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "ip_allow_list.enable_user_level_enforcement", "description": "IP allow list user level enforcement was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "ip_allow_list_entry.create", "description": "An IP address was added to an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "active", + "org", + "ip_allow_list_entry", + "@timestamp", + "_document_id", + "operation_type", + "created_at", + "user_agent", + "action", + "actor_id", + "business_id", + "org_id", + "business", + "actor", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "ip_allow_list_entry.destroy", "description": "An IP address was deleted from an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "ip_allow_list_entry", + "org", + "operation_type", + "created_at", + "active", + "action", + "@timestamp", + "business", + "business_id", + "user_agent", + "org_id", + "actor", + "actor_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "ip_allow_list_entry.update", "description": "An IP address or its description was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "actor", + "org", + "action", + "operation_type", + "created_at", + "user_agent", + "actor_id", + "ip_allow_list_entry", + "active", + "org_id", + "@timestamp" + ] }, { "action": "ip_allow_list.update_ip_allowlist_configuration", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "issue_comment.destroy", "description": "A comment on an issue was deleted from the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "org", + "repo", + "actor_id", + "@timestamp", + "created_at", + "_document_id", + "action", + "operation_type", + "user_agent", + "repo_id", + "actor", + "oauth_application_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "org", + "action", + "repo_id", + "org_id", + "created_at", + "operation_type", + "@timestamp", + "user_agent", + "_document_id", + "actor_id", + "actor", + "oauth_application_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "issue.destroy", "description": "An issue was deleted from the repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue" + "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", + "fields": [ + "user", + "actor_id", + "created_at", + "title", + "@timestamp", + "_document_id", + "actor", + "user_id", + "action", + "operation_type", + "user_agent", + "repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "issue.pinned", "description": "An issue was pinned to a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "_document_id", + "user_agent", + "actor_id", + "created_at", + "action", + "actor", + "operation_type", + "owner_type", + "@timestamp", + "repo_id", + "number", + "repo", + "event", + "user", + "user_id" + ] }, { "action": "issue.transfer", "description": "An issue was transferred to another repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", + "fields": [ + "user", + "user_id", + "@timestamp", + "user_agent", + "owner_type", + "actor_id", + "number", + "repo", + "operation_type", + "_document_id", + "repo_id", + "action", + "created_at", + "actor", + "programmatic_access_type" + ] }, { "action": "issue.unpinned", "description": "An issue was unpinned from a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "event", + "user_agent", + "actor_id", + "repo_id", + "actor", + "action", + "created_at", + "repo", + "operation_type", + "_document_id", + "number", + "owner_type", + "@timestamp", + "user", + "user_id", + "token_scopes" + ] }, { "action": "issues.deletes_disabled", "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "user_agent", + "action", + "@timestamp", + "operation_type", + "actor_id", + "user_id", + "created_at", + "_document_id", + "actor", + "user", + "org", + "org_id" + ] }, { "action": "issues.deletes_enabled", "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "actor", + "@timestamp", + "created_at", + "user_agent", + "operation_type" + ] }, { "action": "issues.deletes_policy_cleared", "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "user", + "actor", + "business_id", + "action", + "operation_type", + "user_agent", + "created_at", + "@timestamp", + "_document_id", + "business", + "user_id", + "actor_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "@timestamp", + "_document_id", + "user_agent", + "operation_type", + "created_at", + "action", + "user", + "user_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "secondary_category", + "actor", + "primary_category", + "user", + "@timestamp", + "_document_id", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_id", + "marketplace_listing", + "integration", + "action" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "primary_category", + "user_agent", + "actor", + "marketplace_listing", + "@timestamp", + "integration", + "org_id", + "action", + "org", + "secondary_category", + "operation_type", + "created_at", + "actor_id", + "_document_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "primary_category", + "_document_id", + "user", + "created_at", + "user_agent", + "oauth_application", + "action", + "marketplace_listing", + "user_id", + "secondary_category", + "oauth_application_id", + "actor", + "actor_id", + "operation_type", + "@timestamp" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "actor", + "actor_id", + "user_agent", + "org_id", + "created_at", + "secondary_category", + "operation_type", + "marketplace_listing", + "action", + "@timestamp", + "_document_id", + "primary_category", + "integration" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "secondary_category", + "oauth_application_id", + "@timestamp", + "action", + "user_agent", + "user_id", + "operation_type", + "oauth_application", + "actor", + "created_at", + "marketplace_listing", + "actor_id", + "primary_category", + "user" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "primary_category", + "secondary_category", + "marketplace_listing", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "members_can_create_pages.disable", "description": "The ability for members to publish GitHub Pages sites was disabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "members_can_create_pages.enable", "description": "The ability for members to publish GitHub Pages sites was enabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "members_can_create_public_pages.disable", "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "members_can_create_public_pages.enable", "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "members_can_delete_repos.clear", "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "_document_id", + "user", + "user_id", + "business", + "operation_type", + "user_agent", + "actor", + "actor_id", + "business_id", + "@timestamp", + "created_at", + "action" + ] }, { "action": "members_can_delete_repos.disable", "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "org", + "_document_id", + "actor_id", + "user", + "user_id", + "user_agent", + "actor", + "operation_type", + "org_id", + "action", + "@timestamp", + "created_at" + ] }, { "action": "members_can_delete_repos.enable", "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "action", + "org_id", + "user_id", + "business", + "actor_id", + "@timestamp", + "_document_id", + "user", + "business_id", + "created_at", + "actor", + "org", + "operation_type", + "user_agent" + ] }, { "action": "members_can_view_dependency_insights.clear", "description": "An enterprise owner cleared the policy setting for viewing dependency insights in any organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "user", + "user_id", + "business", + "business_id", + "created_at", + "actor", + "action", + "operation_type" + ] }, { "action": "members_can_view_dependency_insights.disable", "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "business", + "created_at", + "user_id", + "business_id", + "user", + "org", + "operation_type", + "actor", + "_document_id", + "action", + "user_agent", + "actor_id", + "org_id", + "@timestamp" + ] }, { "action": "members_can_view_dependency_insights.enable", "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "created_at", + "_document_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "operation_type", + "@timestamp", + "action", + "actor", + "actor_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "max_entries_to_build", + "min_entries_to_merge", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "@timestamp", + "_document_id", + "user_id", + "action", + "operation_type", + "created_at" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "action", + "org", + "created_at", + "operation_type", + "org_id", + "@timestamp", + "_document_id", + "user_agent", + "actor" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "org_id", + "_document_id", + "org", + "repo_id", + "action", + "actor", + "created_at", + "operation_type", + "@timestamp", + "user_agent", + "actor_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "migration.destroy_file", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "@timestamp", + "org_id", + "action", + "operation_type", + "created_at", + "repo", + "_document_id", + "repo_id" + ] }, { "action": "migration.download", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "org_id", + "oauth_application_id", + "repo_id", + "operation_type", + "@timestamp", + "user_agent", + "created_at", + "org", + "action", + "_document_id", + "repo", + "actor", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "org", + "created_at", + "oauth_application_id", + "operation_type", + "user_agent", + "actor_id", + "org_id", + "action", + "actor", + "oauth_application", + "@timestamp", + "_document_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "created_at", + "oauth_application_id", + "user_id", + "operation_type", + "@timestamp", + "user_agent", + "oauth_application", + "_document_id", + "actor", + "actor_id", + "action", + "user" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user", + "user_id", + "action", + "oauth_application", + "operation_type", + "actor_id", + "_document_id", + "created_at", + "actor", + "oauth_application_id", + "@timestamp", + "user_agent" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "oauth_application_id", + "oauth_application", + "actor_id", + "user_agent", + "@timestamp", + "user_id", + "action", + "_document_id", + "actor", + "user", + "created_at", + "operation_type" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "actor", + "operation_type", + "created_at", + "user_agent", + "oauth_application", + "actor_id", + "oauth_application_id", + "@timestamp", + "user_id", + "_document_id", + "user", + "action" + ] }, { "action": "org.accept_business_invitation", "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.add_billing_manager", "description": "A billing manager was added to an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", + "fields": [ + "operation_type", + "_document_id", + "user_agent", + "org", + "user_id", + "action", + "created_at", + "org_id", + "user", + "actor", + "actor_id", + "@timestamp" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "permission", + "_document_id", + "org", + "operation_type", + "actor", + "user", + "@timestamp", + "created_at", + "user_agent", + "org_id", + "user_id", + "actor_id", + "action", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "inviter", + "org", + "org_id", + "repo", + "repo_id", + "public_repo", + "permission", + "invitee", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.add_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org_id", + "org", + "team", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "org.advanced_security_policy_selected_member_disabled", "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "org.advanced_security_policy_selected_member_enabled", "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "org.audit_log_export", "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", + "fields": [ + "org_id", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "org", + "action", + "created_at", + "user_agent", + "actor_id" + ] }, { "action": "org.audit_log_git_event_export", "description": "An export of the organization's Git events was created.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "start", + "end", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "business", + "business_id" + ] }, { "action": "org.billing_signup_error", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "user_agent", + "action", + "@timestamp", + "actor_id", + "org_id", + "_document_id", + "actor", + "org", + "operation_type" + ] }, { "action": "org.block_user", "description": "An organization owner blocked a user from accessing the organization's repositories.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", + "fields": [ + "actor", + "user_agent", + "org_id", + "created_at", + "_document_id", + "blocked_user", + "action", + "operation_type", + "actor_id", + "org", + "@timestamp" + ] }, { "action": "org.cancel_business_invitation", "description": "An invitation for an organization to join an enterprise was revoked", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.cancel_invitation", "description": "An invitation sent to a user to join an organization was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "org_id", + "email", + "@timestamp", + "actor", + "action", + "operation_type", + "user_agent", + "org", + "_document_id", + "created_at", + "invitee_email", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "org.clear_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.codeql_enabled", "description": "Code scanning using the default setup was enabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.codespaces_access_updated", "description": "Access to use Codespaces on internal and private repositories was updated for an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "enablement", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.codespaces_ownership_updated", "description": "Ownership and payment for codespaces was updated for an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "owner_type", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.codespaces_team_access_allowed", "description": "A team has been allowed to use Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "team", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.codespaces_team_access_revoked", "description": "A team has been prevented from using Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "team", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.codespaces_user_access_allowed", "description": "A user has been allowed to use Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.codespaces_user_access_revoked", "description": "A user has been prevented from using Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.config.disable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "org", + "action", + "operation_type", + "_document_id", + "actor", + "actor_id", + "@timestamp", + "user_agent", + "org_id", + "created_at" + ] }, { "action": "org.config.disable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "operation_type", + "@timestamp", + "created_at", + "user_agent", + "action", + "actor_id", + "org", + "_document_id", + "actor", + "org_id" + ] }, { "action": "org.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "_document_id", + "operation_type", + "actor_id", + "org_id", + "action", + "created_at", + "actor", + "org", + "@timestamp", + "user_agent" + ] }, { "action": "org.config.enable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "created_at", + "_document_id", + "actor_id", + "actor", + "org", + "org_id", + "operation_type", + "action", + "user_agent" + ] }, { "action": "org.config.enable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "actor", + "actor_id", + "org_id", + "action", + "operation_type", + "@timestamp", + "user_agent", + "org", + "created_at", + "_document_id" + ] }, { "action": "org.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "actor_id", + "action", + "created_at", + "user_agent", + "actor", + "_document_id", + "org_id", + "operation_type", + "org", + "@timestamp" + ] }, { "action": "org.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.confirm_business_invitation", "description": "An invitation for an organization to join an enterprise was confirmed.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.create", "description": "An organization was created.", - "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" + "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", + "fields": [ + "org", + "actor_id", + "actor", + "action", + "@timestamp", + "_document_id", + "user_agent", + "operation_type", + "org_id", + "created_at" + ] }, { "action": "org.create_actions_secret", "description": "A GitHub Actions secret was created for an organization.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.create_integration_secret", "description": "An integration secret was created for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "visibility", + "integration", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "org_credential_authorization.deauthorize", "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", + "fields": [ + "user_agent", + "operation_type", + "created_at", + "actor_id", + "org_id", + "business", + "action", + "@timestamp", + "org", + "_document_id", + "business_id", + "actor", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "org_credential_authorization.grant", "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", + "fields": [ + "user_agent", + "actor", + "@timestamp", + "created_at", + "org_id", + "business_id", + "operation_type", + "_document_id", + "action", + "actor_id", + "business", + "org", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "org_credential_authorization.revoke", "description": "An owner revoked authorized credentials.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", + "fields": [ + "actor", + "org", + "@timestamp", + "owner", + "oauth_application_id", + "org_id", + "operation_type", + "action", + "business", + "created_at", + "business_id", + "actor_id", + "_document_id", + "user_agent" + ] }, { "action": "org.disable_member_team_creation_permission", "description": "Team creation was limited to owners.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "actor", + "@timestamp", + "_document_id", + "user", + "user_id", + "action", + "created_at", + "actor_id", + "user_agent", + "org", + "org_id", + "operation_type" + ] }, { "action": "org.disable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were disabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "actor_id", + "org_id", + "action", + "_document_id", + "@timestamp", + "actor", + "org", + "operation_type", + "user_agent", + "created_at" + ] }, { "action": "org.disable_reader_discussion_creation_permission", "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.disable_saml", "description": "SAML single sign-on was disabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "sso_url", + "issuer", + "action", + "@timestamp", + "_document_id", + "created_at", + "org", + "operation_type" + ] }, { "action": "org.disable_two_factor_requirement", "description": "A two-factor authentication requirement was disabled for the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "org", + "org_id", + "action", + "actor", + "actor_id", + "operation_type", + "@timestamp", + "_document_id", + "user_agent" + ] }, { "action": "org.display_commenter_full_name_disabled", "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "user_id", + "user", + "action", + "operation_type", + "@timestamp", + "_document_id", + "created_at", + "user_agent", + "org", + "actor_id", + "org_id" + ] }, { "action": "org.display_commenter_full_name_enabled", "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "user_agent", + "actor", + "_document_id", + "user_id", + "operation_type", + "@timestamp", + "created_at", + "user", + "action", + "actor_id", + "org_id" + ] }, { "action": "org.enable_member_team_creation_permission", "description": "Team creation by members was allowed.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "org_id", + "user", + "actor", + "operation_type", + "_document_id", + "user_id", + "created_at", + "user_agent", + "actor_id", + "org", + "action", + "@timestamp" + ] }, { "action": "org.enable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were enabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "actor_id", + "operation_type", + "org", + "created_at", + "_document_id", + "actor", + "org_id", + "action", + "user_agent", + "@timestamp" + ] }, { "action": "org.enable_reader_discussion_creation_permission", "description": "An organization owner allowed users with read access to create discussions in an organization", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "org", + "org_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "org.enable_saml", "description": "SAML single sign-on was enabled for the organization.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", + "fields": [ + "actor_id", + "action", + "operation_type", + "actor", + "sso_url", + "org", + "created_at", + "@timestamp", + "issuer", + "org_id", + "_document_id", + "user_agent" + ] }, { "action": "org.enable_two_factor_requirement", "description": "Two-factor authentication is now required for the organization.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "actor_id", + "action", + "_document_id", + "org", + "@timestamp", + "actor", + "user_agent", + "org_id", + "operation_type", + "created_at" + ] }, { "action": "org.integration_manager_added", "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "org_id", + "manager", + "@timestamp", + "actor", + "operation_type", + "_document_id", + "actor_id", + "org", + "action", + "created_at" + ] }, { "action": "org.integration_manager_removed", "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "@timestamp", + "org", + "user_agent", + "action", + "actor", + "actor_id", + "manager", + "operation_type", + "created_at", + "_document_id" + ] }, { "action": "org.invite_member", "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", + "fields": [ + "org", + "user_id", + "org_id", + "user", + "action", + "operation_type", + "_document_id", + "actor", + "@timestamp", + "created_at", + "user_agent", + "actor_id", + "invitee_email", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "org.invite_to_business", "description": "An organization was invited to join an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "org_id", + "user_agent", + "actor_id", + "user_id", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "actor", + "user", + "action" + ] }, { "action": "org.oauth_app_access_approved", "description": "Access to an organization was granted for an OAuth App.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", + "fields": [ + "url", + "actor", + "user_agent", + "actor_id", + "operation_type", + "org_id", + "_document_id", + "org", + "action", + "created_at", + "@timestamp" + ] }, { "action": "org.oauth_app_access_blocked", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "url", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.oauth_app_access_denied", "description": "Access was disabled for an OAuth App that was previously approved.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", + "fields": [ + "url", + "created_at", + "org_id", + "action", + "@timestamp", + "_document_id", + "user_agent", + "org", + "operation_type", + "actor", + "actor_id" + ] }, { "action": "org.oauth_app_access_requested", "description": "An organization member requested that an owner grant an OAuth App access to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "operation_type", + "created_at", + "user_agent", + "actor_id", + "_document_id", + "url", + "org_id", + "action", + "@timestamp", + "org" + ] }, { "action": "org.oauth_app_access_unblocked", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "url", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.rate_limited_invites", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "created_at", + "org_id", + "action", + "actor", + "actor_id", + "user_agent", + "operation_type", + "_document_id", + "org" + ] }, { "action": "org.recovery_code_failed", "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", + "fields": [ + "actor", + "actor_id", + "user_agent", + "reason", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.recovery_code_used", "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.recovery_codes_downloaded", "description": "An organization owner downloaded the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.recovery_codes_generated", "description": "An organization owner generated the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.recovery_codes_printed", "description": "An organization owner printed the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.recovery_codes_viewed", "description": "An organization owner viewed the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", + "fields": [ + "actor", + "operation_type", + "@timestamp", + "_document_id", + "org", + "org_id", + "action", + "created_at", + "user_agent", + "actor_id", + "actor_is_bot" + ] }, { "action": "org.remove_actions_secret", "description": "A GitHub Actions secret was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.remove_billing_manager", "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "user_id", + "user_agent", + "org_id", + "user", + "action", + "_document_id", + "operation_type", + "@timestamp", + "actor", + "org", + "actor_id", + "created_at" + ] }, { "action": "org.remove_integration_secret", "description": "An integration secret was removed from an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "integration", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "actor_id", + "user_agent", + "actor", + "action", + "user_id", + "@timestamp", + "created_at", + "user", + "operation_type", + "org_id", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "org.remove_outside_collaborator", "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "user", + "org_id", + "created_at", + "@timestamp", + "action", + "operation_type", + "user_agent", + "_document_id", + "actor", + "actor_id", + "user_id", + "programmatic_access_type" + ] }, { "action": "org.remove_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org_id", + "org", + "team", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", + "fields": [ + "operation_type", + "org_id", + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "org", + "created_at", + "actor", + "action", + "programmatic_access_type" + ] }, { "action": "org.rename", "description": "An organization was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "_document_id", + "@timestamp", + "org", + "action", + "actor", + "old_login", + "org_id", + "actor_id", + "operation_type", + "created_at" + ] }, { "action": "org.required_workflow_create", "description": "Triggered when a required workflow is created.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.required_workflow_delete", "description": "Triggered when a required workflow is deleted.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.required_workflow_update", "description": "Triggered when a required workflow is updated.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.restore_member", "description": "An organization member was restored.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", + "fields": [ + "user", + "actor", + "user_id", + "_document_id", + "action", + "created_at", + "org_id", + "operation_type", + "@timestamp", + "user_agent", + "org", + "actor_id" + ] }, { "action": "org.runner_group_created", "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "programmatic_access_type" + ] }, { "action": "org.runner_group_removed", "description": "A self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.runner_group_renamed", "description": "A self-hosted runner group was renamed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "org.runner_group_runner_removed", "description": "The REST API was used to remove a self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "runner_group_id", + "runner_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "org.runner_group_runners_added", "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "org.runner_group_runners_updated", "description": "A runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "runner_group_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.runner_group_updated", "description": "The configuration of a self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "runner_group_name", + "runner_group_allow_public", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "programmatic_access_type" + ] }, { "action": "org.runner_group_visiblity_updated", "description": "The visibility of a self-hosted runner group was updated via the REST API.", - "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "visibility", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "org_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org_secret_scanning_generic_secrets.disabled", "description": "Generic secrets have been disabled at the organization level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org_secret_scanning_generic_secrets.enabled", "description": "Generic secrets have been enabled at the organization level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_disabled", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_enabled", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_updated", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.secret_scanning_push_protection_disable", "description": "Push protection for secret scanning was disabled.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.secret_scanning_push_protection_enable", "description": "Push protection for secret scanning was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_disable", "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_enable", "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "org_id", + "org", + "runner_id", + "runner_name", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp" + ] }, { "action": "org.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "org_id", + "org", + "runner_id", + "runner_name", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp" + ] }, { "action": "org.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "org_id", + "runner_id", + "runner_name", + "source_version", + "target_version", + "runner_group_id", + "runner_group_name" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "policy", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "actor", + "actor_id", + "user_agent", + "policy", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "limit", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.set_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "_document_id", + "org_id", + "operation_type", + "actor", + "actor_id", + "@timestamp", + "created_at", + "org", + "action" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "policy", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "user_agent", + "actor", + "actor_id", + "org_id", + "@timestamp", + "org", + "issuer", + "business", + "operation_type", + "created_at", + "business_id", + "_document_id", + "actor_is_bot" + ] }, { "action": "org.transfer", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "actor", + "actor_id", + "user_agent", + "from_business", + "to_business", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.transfer_outgoing", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "business", + "business_id", + "from_business", + "to_business", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.unblock_user", "description": "A user was unblocked from an organization.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", + "fields": [ + "oauth_application_id", + "_document_id", + "blocked_user", + "action", + "operation_type", + "@timestamp", + "created_at", + "actor", + "actor_id", + "org", + "org_id", + "user_agent" + ] }, { "action": "org.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "created_at", + "key", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.update_actions_settings", "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "new_policy", + "updated_allowed_types", + "old_policy", + "updated_access_policy", + "programmatic_access_type" + ] }, { "action": "org.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.update_default_repository_permission", "description": "The default repository permission level for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "action", + "operation_type", + "created_at", + "org", + "org_id", + "@timestamp", + "user_agent", + "permission", + "actor_id", + "old_permission", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.update_integration_secret", "description": "An integration secret was updated for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "visibility", + "integration", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "org_id", + "created_at", + "_document_id", + "user", + "user_id", + "action", + "actor_id", + "old_permission", + "permission", + "actor", + "user_agent", + "operation_type", + "org" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "action", + "@timestamp", + "actor_id", + "permission", + "created_at", + "user_agent", + "org", + "org_id", + "_document_id", + "visibility", + "operation_type" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "actor_id", + "permission", + "action", + "org_id", + "actor", + "created_at", + "_document_id", + "business_id", + "operation_type", + "org", + "user_agent", + "business", + "@timestamp" + ] }, { "action": "org.update_new_repository_default_branch_setting", "description": "The name of the default branch was changed for new repositories in the organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.update_saml_provider_settings", "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "sso_url", + "actor_id", + "operation_type", + "@timestamp", + "issuer", + "org", + "_document_id", + "actor", + "org_id", + "created_at", + "action" + ] }, { "action": "org.update_terms_of_service", "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", - "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" + "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", + "fields": [ + "org_id", + "actor", + "actor_id", + "user_agent", + "operation_type", + "_document_id", + "org", + "action", + "@timestamp", + "created_at" + ] }, { "action": "organization_default_label.create", "description": "A default label was created for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", + "fields": [ + "actor_id", + "actor", + "org", + "org_id", + "operation_type", + "_document_id", + "action", + "created_at", + "@timestamp", + "user_agent" + ] }, { "action": "organization_default_label.destroy", "description": "A default label was deleted for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", + "fields": [ + "operation_type", + "actor", + "@timestamp", + "_document_id", + "actor_id", + "org_id", + "org", + "action", + "created_at", + "user_agent" + ] }, { "action": "organization_default_label.update", "description": "A default label was edited for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", + "fields": [ + "org", + "created_at", + "@timestamp", + "actor", + "action", + "user_agent", + "actor_id", + "org_id", + "operation_type", + "_document_id" + ] }, { "action": "organization_domain.approve", "description": "A domain was approved for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner_type", + "org_id", + "business_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "organization_domain.create", "description": "A domain was added to an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "created_at", + "_document_id", + "action", + "actor_id", + "operation_type", + "@timestamp", + "user_agent", + "actor" + ] }, { "action": "organization_domain.destroy", "description": "A domain was removed from an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", + "fields": [ + "action", + "@timestamp", + "_document_id", + "user_agent", + "actor", + "actor_id", + "operation_type", + "created_at" + ] }, { "action": "organization_domain.verify", "description": "A domain was verified for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "operation_type", + "@timestamp", + "user_agent", + "actor", + "action", + "created_at", + "_document_id", + "actor_id" + ] }, { "action": "organization_moderators.add_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "team", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "organization_moderators.add_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "organization_moderators.remove_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "team", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "organization_moderators.remove_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "programmatic_access_type" + ] }, { "action": "organization_projects_change.clear", "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "actor", + "business_id", + "@timestamp", + "actor_id", + "user", + "user_id", + "action", + "user_agent", + "_document_id", + "created_at", + "operation_type", + "business" + ] }, { "action": "organization_projects_change.disable", "description": "Organization projects were disabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "org_id", + "action", + "user", + "org", + "created_at", + "user_agent", + "actor_id", + "operation_type", + "@timestamp", + "actor", + "user_id", + "_document_id" + ] }, { "action": "organization_projects_change.enable", "description": "Organization projects were enabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "actor_id", + "org_id", + "created_at", + "user_id", + "org", + "@timestamp", + "_document_id", + "user_agent", + "actor", + "user", + "action", + "operation_type" + ] }, { "action": "organization_role.assign", "description": "An organization role was assigned to a user or team.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "actor", + "actor_id", + "user_agent", + "organization_role_id", + "organization_role_name", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "organization_role.create", "description": "A custom organization role was created in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "name", + "owner", + "role_permissions", + "base_role", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "organization_role.destroy", "description": "A custom organization role was deleted in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "name", + "owner", + "role_permissions", + "base_role", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "organization_role.revoke", "description": "A user or team was unassigned an organization role.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "actor", + "actor_id", + "user_agent", + "organization_role_id", + "organization_role_name", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "organization_role.update", "description": "A custom organization role was edited in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "name", + "owner", + "role_permissions", + "base_role", + "old_role_permissions", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "packages.package_deleted", "description": "An entire package was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "actor_id", + "actor", + "org", + "org_id", + "repo", + "repo_id", + "package", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "packages.package_published", "description": "A package was published or republished to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "actor", + "org", + "org_id", + "repo", + "repo_id", + "package", + "ecosystem", + "version_count", + "is_republished", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "packages.package_version_deleted", "description": "A specific package version was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "actor_id", + "actor", + "org", + "org_id", + "repo", + "repo_id", + "package", + "version", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "ecosystem", + "actor_is_bot" + ] }, { "action": "packages.package_version_published", "description": "A specific package version was published or republished to a package.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "ecosystem", + "package", + "version", + "actor_id", + "user_agent", + "is_republished", + "actor", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "owner_type", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "owner_type", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "owner_type", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "user", + "operation_type", + "user_id", + "_document_id", + "action", + "actor", + "actor_id", + "@timestamp", + "created_at" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "created_at", + "actor_id", + "@timestamp", + "user_id", + "action", + "operation_type", + "actor", + "_document_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "org_id", + "created_at", + "actor_id", + "@timestamp", + "action", + "actor", + "org", + "user_agent", + "_document_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "repository_selection", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "repository_selection", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "org", + "org_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "user", + "user_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user_programmatic_access_name", + "org", + "org_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "prebuild_configuration.create", "description": "A GitHub Codespaces prebuild configuration for a repository was created.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "user_agent", + "actor", + "actor_id", + "branch", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "prebuild_configuration.destroy", "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "user_agent", + "actor", + "actor_id", + "branch", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "prebuild_configuration.run_triggered", "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "user_agent", + "actor", + "actor_id", + "branch", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "prebuild_configuration.update", "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "user_agent", + "actor", + "actor_id", + "branch", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_repository_forking.clear", "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "user_id", + "action", + "operation_type", + "@timestamp", + "business_id", + "actor_id", + "user", + "business", + "actor", + "created_at", + "_document_id" + ] }, { "action": "private_repository_forking.disable", "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "created_at", + "actor_id", + "_document_id", + "actor", + "user", + "repo", + "action", + "user_agent", + "@timestamp", + "org", + "operation_type", + "user_id", + "org_id", + "programmatic_access_type" + ] }, { "action": "private_repository_forking.enable", "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user_id", + "operation_type", + "_document_id", + "action", + "@timestamp", + "repo", + "org", + "business", + "user_agent", + "actor", + "repo_id", + "user", + "org_id", + "created_at", + "business_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "user", + "actor_id", + "user_id", + "@timestamp", + "created_at", + "owner", + "action", + "_document_id", + "user_agent", + "actor", + "operation_type" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "actor", + "user_agent", + "operation_type", + "user", + "created_at", + "user_id", + "action", + "_document_id", + "@timestamp" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "org_id", + "user_agent", + "operation_type", + "@timestamp", + "created_at", + "repo_id", + "org", + "_document_id", + "action", + "actor", + "actor_id", + "repo" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user", + "_document_id", + "user_id", + "user_agent", + "@timestamp", + "actor_id", + "action", + "created_at", + "actor" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "actor_id", + "operation_type", + "actor", + "user_id", + "@timestamp", + "created_at", + "_document_id", + "user_agent", + "user" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "action", + "actor_id", + "org_id", + "user_agent", + "actor", + "operation_type", + "@timestamp", + "_document_id", + "created_at", + "org", + "repo" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "actor", + "actor_id", + "action", + "user_id", + "_document_id", + "user_agent", + "operation_type", + "user", + "@timestamp", + "created_at" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "created_at", + "actor_id", + "old_name", + "operation_type", + "@timestamp", + "repo", + "_document_id", + "user_agent", + "org_id", + "business_id", + "actor", + "repo_id", + "org", + "business" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "repo_id", + "operation_type", + "actor", + "action", + "created_at", + "actor_id", + "_document_id", + "@timestamp", + "user_agent", + "org", + "org_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "org", + "@timestamp", + "_document_id", + "operation_type", + "created_at", + "actor_id", + "action", + "org_id", + "user_agent" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "org_id", + "operation_type", + "org", + "actor_id", + "_document_id", + "team", + "@timestamp", + "action", + "user_agent", + "actor" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "operation_type", + "@timestamp", + "actor_id", + "user", + "user_agent", + "actor", + "created_at", + "org", + "_document_id", + "org_id", + "action", + "programmatic_access_type" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "protected_branch.authorized_users_teams", "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", + "fields": [ + "repo", + "action", + "org_id", + "user_agent", + "name", + "created_at", + "_document_id", + "operation_type", + "actor", + "repo_id", + "org", + "actor_id", + "oauth_application_id", + "@timestamp", + "programmatic_access_type" + ] }, { "action": "protected_branch.branch_allowances", "description": "A protected branch allowance was given to a specific user, team or integration.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "token_id", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "name", + "authorized_actors", + "policy", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "protected_branch.create", "description": "Branch protection was enabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "repo_id", + "user_id", + "@timestamp", + "user_agent", + "repo", + "name", + "org_id", + "user", + "_document_id", + "actor", + "actor_id", + "org", + "action", + "created_at", + "authorized_actor_names", + "token_scopes", + "required_deployments_enforcement_level", + "merge_queue_enforcement_level", + "create_protected" + ] }, { "action": "protected_branch.destroy", "description": "Branch protection was disabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "name", + "repo", + "@timestamp", + "actor", + "org", + "actor_id", + "repo_id", + "org_id", + "operation_type", + "action", + "user_agent", + "created_at", + "_document_id", + "token_scopes", + "required_deployments_enforcement_level", + "merge_queue_enforcement_level", + "create_protected" + ] }, { "action": "protected_branch.dismiss_stale_reviews", "description": "Enforcement of dismissing stale pull requests was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "dismiss_stale_reviews_on_push", + "org_id", + "action", + "created_at", + "_document_id", + "@timestamp", + "actor_id", + "repo_id", + "operation_type", + "actor", + "repo", + "org", + "name", + "programmatic_access_type" + ] }, { "action": "protected_branch.dismissal_restricted_users_teams", "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "repo_id", + "actor", + "oauth_application_id", + "authorized_actors_only", + "authorized_actors", + "created_at", + "user_agent", + "name", + "_document_id", + "org_id", + "@timestamp", + "actor_id", + "org", + "action", + "operation_type", + "programmatic_access_type" + ] }, { "action": "protected_branch.policy_override", "description": "A branch protection requirement was overridden by a repository administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "created_at", + "actor", + "reasons", + "@timestamp", + "before", + "after", + "actor_id", + "repo", + "operation_type", + "user_agent", + "branch", + "overridden_codes", + "org", + "org_id", + "action", + "_document_id", + "referrer", + "business", + "business_id", + "deploy_key_fingerprint", + "token_scopes", + "programmatic_access_type", + "compliant_pull_request_ids" + ] }, { "action": "protected_branch.rejected_ref_update", "description": "A branch update attempt was rejected.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "org", + "@timestamp", + "created_at", + "_document_id", + "business", + "org_id", + "operation_type", + "repo_id", + "actor", + "branch", + "action", + "actor_id", + "business_id", + "deploy_key_fingerprint", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "protected_branch.update_admin_enforced", "description": "Branch protection was enforced for repository administrators.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "admin_enforced", + "operation_type", + "user_agent", + "actor", + "org", + "name", + "repo", + "@timestamp", + "action", + "repo_id", + "org_id", + "_document_id", + "created_at", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_allow_force_pushes_enforcement_level", "description": "Force pushes were enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "actor_id", + "name", + "_document_id", + "actor", + "repo", + "operation_type", + "allow_force_pushes_enforcement_level", + "@timestamp", + "org", + "action", + "created_at", + "user_agent", + "repo_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_ignore_approvals_from_contributors", "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "ignore_approvals_from_contributors", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "protected_branch.update_lock_allows_fetch_and_merge", "description": "Fork syncing was enabled or disabled for a read-only branch", - "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "lock_allows_fetch_and_merge", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_lock_branch_enforcement_level", "description": "The enforcement of a branch lock was updated.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "enforcement_level", + "lock_branch_enforcement_level", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "merge_queue_enforcement_level", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "protected_branch.update_name", "description": "A branch name pattern was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "old_name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_pull_request_reviews_enforcement_level", "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "name", + "org_id", + "_document_id", + "actor_id", + "@timestamp", + "business_id", + "pull_request_reviews_enforcement_level", + "org", + "repo", + "action", + "business", + "user_agent", + "created_at", + "repo_id", + "operation_type", + "actor", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_require_code_owner_review", "description": "Enforcement of required code owner review was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "created_at", + "require_code_owner_review", + "operation_type", + "name", + "user_agent", + "action", + "@timestamp", + "actor", + "actor_id", + "repo", + "org", + "repo_id", + "_document_id", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_require_last_push_approval", "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "require_last_push_approval", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_required_approving_review_count", "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "required_approving_review_count", + "repo", + "repo_id", + "created_at", + "actor", + "operation_type", + "user_agent", + "name", + "org_id", + "action", + "actor_id", + "_document_id", + "org", + "@timestamp", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_required_status_checks_enforcement_level", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "org_id", + "user_agent", + "@timestamp", + "_document_id", + "name", + "repo", + "action", + "business_id", + "repo_id", + "business", + "actor_id", + "operation_type", + "created_at", + "required_status_checks_enforcement_level", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_signature_requirement_enforcement_level", "description": "Enforcement of required commit signing was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "name", + "@timestamp", + "created_at", + "_document_id", + "repo_id", + "org", + "org_id", + "action", + "actor", + "actor_id", + "signature_requirement_enforcement_level", + "repo", + "user_agent", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_strict_required_status_checks_policy", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "_document_id", + "org", + "@timestamp", + "created_at", + "repo_id", + "org_id", + "user_agent", + "name", + "actor", + "repo", + "operation_type", + "action", + "strict_required_status_checks_policy", + "programmatic_access_type" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "read_only", + "user_agent", + "actor_id", + "operation_type", + "created_at", + "_document_id", + "key", + "fingerprint", + "actor", + "action", + "user", + "user_id", + "@timestamp", + "title", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "fingerprint", + "user_agent", + "read_only", + "explanation", + "repo", + "@timestamp", + "action", + "key", + "operation_type", + "_document_id", + "actor", + "title", + "actor_id", + "repo_id", + "created_at", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "user_agent", + "title", + "key", + "fingerprint", + "read_only", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "created_at", + "operation_type", + "_document_id", + "title", + "key", + "action", + "actor", + "read_only", + "explanation", + "repo_id", + "@timestamp", + "actor_id", + "repo", + "user_agent", + "fingerprint" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "actor", + "user_agent", + "key", + "fingerprint", + "read_only", + "repo_id", + "operation_type", + "created_at", + "actor_id", + "repo", + "action", + "_document_id", + "title", + "@timestamp", + "programmatic_access_type" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "repo_id", + "actor", + "key", + "fingerprint", + "@timestamp", + "actor_id", + "oauth_application_id", + "title", + "action", + "user_agent", + "created_at", + "repo", + "read_only", + "operation_type", + "_document_id", + "user", + "user_id", + "programmatic_access_type" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "operation_type", + "user", + "@timestamp", + "_document_id", + "action", + "created_at", + "key", + "fingerprint", + "actor_id", + "actor", + "title", + "user_agent", + "user_id", + "read_only", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request.close", "description": "A pull request was closed without being merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "pull_request.converted_to_draft", "description": "A pull request was converted to a draft.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request.create", "description": "A pull request was created.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "pull_request.create_review_request", "description": "A review was requested on a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "pull_request.in_progress", "description": "A pull request was marked as in progress.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "pull_request.indirect_merge", "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "pull_request.merge", "description": "A pull request was merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "pull_request.ready_for_review", "description": "A pull request was marked as ready for review.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request.rebase", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "pull_request_url", + "pull_request_title", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "programmatic_access_type" + ] }, { "action": "pull_request.remove_review_request", "description": "A review request was removed from a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "pull_request.reopen", "description": "A pull request was reopened after previously being closed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "pull_request_review_comment.create", "description": "A review comment was added to a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request_review_comment.delete", "description": "A review comment on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "@timestamp", + "_document_id", + "repo", + "created_at", + "actor_id", + "repo_id", + "action", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request_review_comment.update", "description": "A review comment on a pull request was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user_agent", + "actor_id", + "action", + "created_at", + "actor", + "_document_id", + "@timestamp", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request_review.delete", "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request_review.dismiss", "description": "A review on a pull request was dismissed.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "pull_request_review.submit", "description": "A review on a pull request was submitted.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "repo_id", + "user", + "operation_type", + "@timestamp", + "actor_id", + "user_id", + "created_at", + "user_agent", + "actor", + "action", + "repo", + "visibility", + "_document_id", + "previous_visibility", + "programmatic_access_type" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "visibility", + "repo", + "created_at", + "user_agent", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "actor_id", + "repo_id", + "user", + "action", + "user_id", + "oauth_application_id", + "org", + "org_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "action", + "user_agent", + "actor", + "repo", + "repo_id", + "user", + "org", + "org_id", + "actor_id", + "topic", + "@timestamp", + "_document_id", + "user_id", + "created_at", + "operation_type", + "programmatic_access_type" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "repo_id", + "user_agent", + "user_id", + "created_at", + "@timestamp", + "repo", + "user", + "operation_type", + "visibility", + "action", + "actor_id", + "actor", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "oauth_application_id", + "user_agent", + "created_at", + "@timestamp", + "_document_id", + "actor_id", + "operation_type", + "action", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "tool", + "category" + ] + }, + { + "action": "repo.code_scanning_autofix_disabled", + "description": "Autofix for code scanning alerts was disabled for a repository.", + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] + }, + { + "action": "repo.code_scanning_autofix_enabled", + "description": "Autofix for code scanning alerts was enabled for a repository.", + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "actor", + "actor_id", + "user_agent", + "tool", + "branch", + "category", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.codeql_disabled", "description": "Code scanning using the default setup was disabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.codeql_enabled", "description": "Code scanning using the default setup was enabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to this repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "repo.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to this repository was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo_id", + "_document_id", + "action", + "created_at", + "repo", + "operation_type", + "@timestamp" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "repo", + "@timestamp", + "actor", + "_document_id", + "user_agent", + "actor_id", + "repo_id", + "action", + "operation_type", + "created_at" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "actor", + "repo_id", + "action", + "user_agent", + "_document_id", + "@timestamp", + "created_at", + "actor_id", + "repo", + "operation_type" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "actor", + "oauth_application_id", + "created_at", + "action", + "repo_id", + "repo", + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "operation_type" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "user_agent", + "operation_type", + "created_at", + "actor", + "org", + "action", + "actor_id", + "repo", + "repo_id", + "org_id", + "@timestamp", + "_document_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "actor", + "operation_type", + "created_at", + "user_agent", + "action", + "actor_id", + "repo", + "repo_id", + "@timestamp", + "_document_id" + ] }, { "action": "repo.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "repo", + "user_id", + "visibility", + "repo_id", + "user", + "actor_id", + "action", + "operation_type", + "request_category", + "@timestamp", + "created_at", + "_document_id", + "actor", + "user_agent", + "org", + "oauth_application_id", + "org_id", + "request_method", + "business", + "business_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "visibility", + "integration", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "repo", + "_document_id", + "user_agent", + "user_id", + "actor", + "action", + "user", + "repo_id", + "operation_type", + "request_category", + "actor_id", + "visibility", + "created_at", + "@timestamp", + "request_method", + "oauth_application_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.download_zip", "description": "A source code archive of a repository was downloaded as a ZIP file.", - "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives" + "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "@timestamp", + "visibility", + "repo", + "repo_id", + "user", + "actor_id", + "user_agent", + "user_id", + "created_at", + "_document_id", + "action", + "operation_type", + "programmatic_access_type" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user", + "_document_id", + "user_id", + "visibility", + "action", + "user_agent", + "operation_type", + "repo_id", + "created_at", + "@timestamp", + "actor", + "repo", + "programmatic_access_type" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "user_id", + "action", + "user", + "repo", + "user_agent", + "_document_id", + "actor_id", + "@timestamp", + "actor", + "visibility", + "operation_type", + "repo_id", + "programmatic_access_type" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "actor_id", + "repo_id", + "_document_id", + "user_agent", + "actor", + "visibility", + "user_id", + "repo", + "@timestamp", + "operation_type", + "action", + "created_at", + "programmatic_access_type" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "user_agent", + "user_id", + "created_at", + "visibility", + "actor", + "actor_id", + "user", + "operation_type", + "repo_id", + "action", + "repo", + "_document_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "repo.pages_soft_delete", "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.pages_soft_delete_restore", "description": "A GitHub Pages site that was previously soft-deleted was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "actor_id", + "operation_type", + "user_agent", + "actor", + "@timestamp", + "repo_id", + "user", + "_document_id", + "visibility", + "repo", + "created_at", + "action", + "programmatic_access_type" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "actor_id", + "repo", + "operation_type", + "action", + "@timestamp", + "actor", + "user_agent", + "created_at", + "_document_id", + "repo_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "integration", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "user", + "business", + "action", + "actor_id", + "org", + "org_id", + "actor", + "created_at", + "repo_id", + "user_agent", + "business_id", + "user_id", + "operation_type", + "@timestamp", + "_document_id", + "visibility", + "repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "actor_id", + "repo_id", + "@timestamp", + "_document_id", + "repo", + "org_id", + "action", + "operation_type", + "user_agent", + "actor", + "created_at", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "action", + "repo_id", + "user_agent", + "topic", + "operation_type", + "user_id", + "org", + "org_id", + "actor", + "business", + "repo", + "@timestamp", + "created_at", + "_document_id", + "actor_id", + "business_id", + "programmatic_access_type" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "user_agent", + "@timestamp", + "actor_id", + "actor", + "old_name", + "repo", + "user_id", + "created_at", + "user", + "action", + "operation_type", + "visibility", + "repo_id", + "_document_id", + "programmatic_access_type" + ] }, { "action": "repo.rename_branch", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "old_branch", + "new_branch", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "action", + "_document_id", + "actor_id", + "user", + "operation_type", + "user_agent", + "repo_id", + "@timestamp", + "created_at", + "actor", + "user_id" + ] }, { "action": "repo.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "repo_id", + "repo", + "org_id", + "org", + "runner_id", + "runner_name", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp" + ] }, { "action": "repo.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "repo_id", + "repo", + "org_id", + "org", + "runner_id", + "runner_name", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp" + ] }, { "action": "repo.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "repo_id", + "runner_id", + "runner_name", + "source_version", + "target_version", + "runner_group_id", + "runner_group_name" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "policy", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "policy", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "limit", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "repo", + "repo_id", + "public_repo", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "policy", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "repo", + "repo_id", + "public_repo", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "created_at", + "actor", + "repo_id", + "action", + "org", + "org_id", + "repo", + "operation_type" + ] }, { "action": "repo.temporary_access_granted", "description": "Temporary access was enabled for a repository.", - "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "user_id", + "_document_id", + "actor_id", + "repo_id", + "owner", + "user", + "old_user", + "action", + "operation_type", + "created_at", + "user_agent", + "repo", + "visibility", + "repo_was", + "actor" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "visibility", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "operation_type", + "user_id", + "user", + "action", + "user_agent", + "created_at", + "actor", + "visibility", + "repo_id", + "actor_id", + "repo" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "actor", + "actor_id", + "repo", + "operation_type", + "created_at", + "_document_id", + "repo_id", + "user", + "@timestamp", + "visibility", + "user_agent", + "user_id", + "action", + "programmatic_access_type" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "policy", + "old_policy", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "new_policy", + "old_policy", + "updated_access_policy", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "visibility", + "integration", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "action", + "_document_id", + "actor", + "repo_id", + "created_at", + "oauth_application_id", + "user", + "@timestamp", + "repo", + "operation_type", + "org_id", + "actor_id", + "visibility", + "old_permission", + "org", + "user_id", + "old_base_role", + "old_repo_permission", + "old_repo_base_role", + "new_repo_base_role", + "new_repo_permission", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repository_advisory.close", "description": "Someone closed a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", + "fields": [ + "actor", + "repo", + "@timestamp", + "business", + "business_id", + "user_agent", + "actor_id", + "action", + "operation_type", + "created_at", + "repo_id", + "_document_id", + "org", + "org_id" + ] }, { "action": "repository_advisory.cve_request", "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "repo", + "org_id", + "actor", + "action", + "org", + "operation_type", + "@timestamp", + "user_agent", + "actor_id", + "_document_id", + "created_at" + ] }, { "action": "repository_advisory.github_broadcast", "description": "GitHub made a security advisory public in the GitHub Advisory Database.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "repository_advisory.github_withdraw", "description": "GitHub withdrew a security advisory that was published in error.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repository_advisory.open", "description": "Someone opened a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user_agent", + "actor_id", + "actor", + "repo", + "created_at", + "_document_id", + "repo_id", + "action", + "@timestamp" + ] }, { "action": "repository_advisory.publish", "description": "Someone published a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user_agent", + "actor_id", + "@timestamp", + "actor", + "repo_id", + "_document_id", + "repo", + "business_id", + "business", + "action", + "created_at", + "org_id", + "org" + ] }, { "action": "repository_advisory.reopen", "description": "Someone reopened as draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user_agent", + "repo", + "action", + "created_at", + "@timestamp", + "actor_id", + "_document_id", + "actor", + "repo_id", + "public_repo" + ] }, { "action": "repository_advisory.update", "description": "Someone edited a draft or published security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "repo_id", + "org_id", + "business", + "actor", + "user_agent", + "created_at", + "_document_id", + "business_id", + "repo", + "action", + "operation_type", + "org", + "@timestamp" + ] }, { "action": "repository_branch_protection_evaluation.disable", "description": "Branch protections were disabled for the repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "org", + "org_id", + "business_id", + "user", + "user_id", + "business", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repository_branch_protection_evaluation.enable", "description": "Branch protections were enabled for this repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "org", + "org_id", + "business_id", + "user", + "user_id", + "business", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repository_content_analysis.disable", "description": "Data use settings were disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "user", + "repo_id", + "actor_id", + "created_at", + "user_agent", + "action", + "operation_type", + "actor", + "repo", + "user_id", + "@timestamp", + "_document_id" + ] }, { "action": "repository_content_analysis.enable", "description": "Data use settings were enabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "user", + "org", + "user_id", + "repo_id", + "@timestamp", + "actor", + "action", + "operation_type", + "created_at", + "actor_id", + "repo", + "user_agent", + "org_id", + "_document_id" + ] }, { "action": "repository_dependency_graph.disable", "description": "The dependency graph was disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "repo_id", + "operation_type", + "user_id", + "repo", + "_document_id", + "actor", + "user", + "action", + "@timestamp", + "org_id", + "actor_id", + "org", + "created_at", + "user_agent", + "programmatic_access_type" + ] }, { "action": "repository_dependency_graph.enable", "description": "The dependency graph was enabled for a private repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "org", + "org_id", + "action", + "repo", + "user_id", + "created_at", + "user_agent", + "actor_id", + "repo_id", + "operation_type", + "actor", + "@timestamp", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "operation_type", + "created_at", + "actor_id", + "repo_id", + "action", + "actor", + "content_type", + "repo", + "@timestamp", + "_document_id", + "user", + "user_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "content_type", + "created_at", + "actor_id", + "user_id", + "operation_type", + "_document_id", + "actor", + "repo_id", + "user_agent", + "repo", + "user", + "action", + "@timestamp" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "created_at", + "repo", + "invitee", + "operation_type", + "actor", + "repo_id", + "_document_id", + "action", + "user_agent", + "inviter", + "@timestamp", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "inviter", + "action", + "operation_type", + "_document_id", + "repo_id", + "repo", + "@timestamp", + "user_agent", + "invitee", + "created_at", + "actor", + "actor_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "actor", + "actor_id", + "@timestamp", + "invitee", + "action", + "inviter", + "repo", + "created_at", + "user_agent", + "repo_id", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "_document_id", + "actor", + "invitee", + "action", + "@timestamp", + "actor_id", + "operation_type", + "created_at", + "inviter", + "user_agent", + "repo_id" + ] }, { "action": "repository_projects_change.clear", "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", + "fields": [ + "created_at", + "_document_id", + "action", + "user_agent", + "user", + "business_id", + "business", + "operation_type", + "actor", + "actor_id", + "user_id", + "@timestamp" + ] }, { "action": "repository_projects_change.disable", "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "@timestamp", + "repo", + "action", + "operation_type", + "_document_id", + "actor_id", + "user", + "user_id", + "user_agent", + "repo_id", + "actor", + "programmatic_access_type" + ] }, { "action": "repository_projects_change.enable", "description": "Repository projects were enabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "actor", + "repo_id", + "org", + "user", + "user_agent", + "created_at", + "org_id", + "action", + "user_id", + "operation_type", + "_document_id", + "actor_id", + "repo" + ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "ruleset_id", + "ruleset_name", + "ruleset_enforcement", + "ruleset_source_type", + "ruleset_rules", + "ruleset_conditions", + "ruleset_bypass_actors" + ] }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", + "fields": [ + "actor", + "actor_id", + "user_agent", + "old_name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "ruleset_id", + "ruleset_name", + "ruleset_enforcement", + "ruleset_source_type", + "ruleset_rules_updated", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_old_enforcement", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_old_name", + "ruleset_conditions_updated", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo" + ] }, { "action": "repository_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo" + ] }, { "action": "repository_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo" + ] }, { "action": "repository_secret_scanning.disable", "description": "Secret scanning was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "repository_secret_scanning.enable", "description": "Secret scanning was enabled for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "repository_secret_scanning_generic_secrets.disabled", "description": "Generic secrets have been disabled at the repository level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_generic_secrets.enabled", "description": "Generic secrets have been enabled at the repository level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_push_protection.disable", "description": "Secret scanning push protection was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "repository_secret_scanning_push_protection.enable", "description": "Secret scanning push protection was enabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "repository_visibility_change.clear", "description": "The repository visibility change setting was cleared for an organization or enterprise.", - "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility" + "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", + "fields": [ + "created_at", + "_document_id", + "actor_id", + "business", + "action", + "operation_type", + "user", + "user_id", + "business_id", + "@timestamp", + "user_agent", + "actor" + ] }, { "action": "repository_visibility_change.disable", "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "org_id", + "created_at", + "user_agent", + "actor", + "actor_id", + "org", + "operation_type", + "_document_id", + "@timestamp", + "user_id", + "action" + ] }, { "action": "repository_visibility_change.enable", "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "operation_type", + "_document_id", + "@timestamp", + "user_agent", + "user", + "created_at", + "org", + "org_id", + "action", + "actor_id", + "user_id" + ] }, { "action": "repository_vulnerability_alert.auto_dismiss", "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", + "fields": [ + "actor", + "actor_id", + "user_agent", + "alert_number", + "ghsa_id", + "action", + "repo", + "repo_id", + "public_repo", + "owner", + "org", + "org_id", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repository_vulnerability_alert.auto_reopen", "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", + "fields": [ + "actor", + "actor_id", + "user_agent", + "alert_number", + "ghsa_id", + "action", + "repo", + "repo_id", + "public_repo", + "owner", + "org", + "org_id", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repository_vulnerability_alert.create", "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", + "fields": [ + "operation_type", + "repo_id", + "@timestamp", + "user_agent", + "action", + "repo", + "created_at", + "_document_id", + "token_scopes", + "alert_number", + "programmatic_access_type" + ] }, { "action": "repository_vulnerability_alert.dismiss", "description": "A Dependabot alert was manually dismissed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "org_id", + "user_id", + "@timestamp", + "operation_type", + "user_agent", + "actor", + "repo", + "created_at", + "org", + "_document_id", + "action", + "actor_id", + "dismiss_reason", + "user", + "dismiss_comment", + "alert_number", + "actor_is_bot" + ] }, { "action": "repository_vulnerability_alert.reintroduce", "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "action", + "repo", + "repo_id", + "public_repo", + "owner", + "_document_id", + "@timestamp", + "operation_type", + "token_scopes", + "alert_number" + ] }, { "action": "repository_vulnerability_alert.reopen", "description": "A Dependabot alert was manually reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "action", + "repo", + "repo_id", + "owner", + "org", + "org_id", + "_document_id", + "@timestamp", + "operation_type", + "business", + "business_id", + "public_repo", + "alert_number" + ] }, { "action": "repository_vulnerability_alert.resolve", "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "operation_type", + "action", + "repo_id", + "_document_id", + "user_agent", + "@timestamp", + "created_at", + "actor", + "actor_id", + "token_scopes", + "alert_number", + "programmatic_access_type" + ] }, { "action": "repository_vulnerability_alerts.authorized_users_teams", "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", + "fields": [ + "org", + "_document_id", + "repo", + "org_id", + "operation_type", + "created_at", + "actor", + "action", + "@timestamp", + "user_agent", + "repo_id", + "actor_id" + ] }, { "action": "repository_vulnerability_alerts_auto_dismissal.disable", "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repository_vulnerability_alerts_auto_dismissal.enable", "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_vulnerability_alerts.disable", "description": "Dependabot alerts was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "repo_id", + "action", + "actor_id", + "@timestamp", + "created_at", + "actor", + "user_agent", + "org_id", + "user", + "org", + "_document_id", + "user_id", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repository_vulnerability_alerts.enable", "description": "Dependabot alerts was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "user_agent", + "created_at", + "@timestamp", + "repo_id", + "action", + "user", + "repo", + "org", + "org_id", + "actor_id", + "_document_id", + "user_id", + "operation_type", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "required_status_check.create", "description": "A status check was marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "org", + "actor_id", + "@timestamp", + "business", + "context", + "repo_id", + "action", + "repo", + "_document_id", + "operation_type", + "business_id", + "org_id", + "actor", + "created_at", + "user_agent", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "required_status_check.destroy", "description": "A status check was no longer marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "actor_id", + "actor", + "created_at", + "context", + "operation_type", + "@timestamp", + "org", + "user_agent", + "repo_id", + "org_id", + "action", + "_document_id", + "repo", + "programmatic_access_type" + ] }, { "action": "restrict_notification_delivery.disable", "description": "Email notification restrictions for an organization or enterprise were disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "restrict_notification_delivery.enable", "description": "Email notification restrictions for an organization or enterprise were enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "role.create", "description": "A new custom repository role was created.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "name", + "owner", + "base_role", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "role_permissions", + "old_role_permissions" + ] }, { "action": "role.destroy", "description": "A custom repository role was deleted.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "name", + "owner", + "role_permissions", + "base_role", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "role.update", "description": "A custom repository role was edited.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "owner", + "role_permissions", + "base_role", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "old_role_permissions", + "old_base_role" + ] }, { "action": "secret_scanning_alert.create", "description": "GitHub detected a secret and created a secret scanning alert.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "repo_id", + "repo", + "actor_id", + "actor", + "org_id", + "org", + "business", + "business_id", + "number" + ] }, { "action": "secret_scanning_alert.reopen", "description": "A seret scanning alert was reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "number", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes" + ] }, { "action": "secret_scanning_alert.resolve", "description": "A seret scanning alert was resolved.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "number", + "resolution", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes" + ] }, { "action": "secret_scanning_alert.revoke", "description": "A secret scanning alert was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "number", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "secret_scanning_alert.validate", "description": "A secret scanning alert was validated.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "repo_id", + "repo", + "actor_id", + "actor", + "org_id", + "org", + "business", + "business_id", + "number", + "created_at", + "previous_validity", + "current_validity" + ] }, { "action": "secret_scanning.disable", "description": "Secret scanning was disabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "secret_scanning.enable", "description": "Secret scanning was enabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "secret_scanning_new_repos.disable", "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "secret_scanning_new_repos.enable", "description": "Secret scanning was enabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "secret_scanning_push_protection.bypass", "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", + "fields": [ + "repo_id", + "repo", + "actor_id", + "actor", + "org_id", + "org", + "business", + "business_id", + "number", + "created_at", + "push_protection_bypass_reason" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "action", + "created_at", + "_document_id", + "actor", + "user_agent", + "actor_id", + "operation_type" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "operation_type", + "_document_id", + "created_at", + "actor", + "user", + "action", + "actor_id", + "user_id", + "@timestamp" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "actor", + "user_id", + "action", + "@timestamp", + "user_agent", + "user", + "operation_type", + "created_at", + "actor_id", + "_document_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "active", + "user", + "user_id", + "actor", + "actor_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "actor_id", + "action", + "@timestamp", + "user_id", + "created_at", + "user", + "_document_id", + "user_agent", + "actor", + "operation_type" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "user_id", + "actor", + "actor_id", + "action", + "user", + "operation_type", + "@timestamp", + "_document_id", + "created_at" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "user_id", + "action", + "user_agent", + "actor", + "user", + "operation_type", + "@timestamp", + "created_at", + "actor_id", + "_document_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "user_id", + "operation_type", + "actor_id", + "@timestamp", + "_document_id", + "user", + "action", + "created_at", + "user_agent", + "actor" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "actor_id", + "operation_type", + "created_at", + "user_agent", + "actor", + "action", + "_document_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "created_at", + "user", + "action", + "user_agent", + "operation_type", + "_document_id", + "actor", + "actor_id", + "user_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "user_agent", + "user", + "@timestamp", + "actor_id", + "user_id", + "_document_id", + "actor", + "action", + "operation_type", + "created_at" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "operation_type", + "actor", + "user_id", + "action", + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "user", + "created_at" + ] }, { "action": "sponsors.sponsors_patreon_user_create", "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", + "fields": [ + "actor", + "actor_id", + "user_agent", + "patreon_email", + "patreon_username", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.sponsors_patreon_user_destroy", "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", + "fields": [ + "actor", + "actor_id", + "user_agent", + "patreon_email", + "patreon_username", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "ssh_certificate_authority.create", "description": "An SSH certificate authority for an organization or enterprise was created.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "fingerprint", + "operation_type", + "openssh_public_key", + "org_id", + "actor", + "created_at", + "org", + "action", + "user_agent", + "actor_id" + ] }, { "action": "ssh_certificate_authority.destroy", "description": "An SSH certificate authority for an organization or enterprise was deleted.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "created_at", + "_document_id", + "fingerprint", + "operation_type", + "actor", + "org_id", + "openssh_public_key", + "org", + "action", + "user_agent", + "actor_id", + "@timestamp" + ] }, { "action": "ssh_certificate_requirement.disable", "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "user", + "user_agent", + "operation_type", + "_document_id", + "org", + "org_id", + "created_at", + "actor", + "action", + "user_id", + "business", + "business_id", + "@timestamp", + "actor_id" + ] }, { "action": "ssh_certificate_requirement.enable", "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "actor_id", + "user_id", + "org", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "user", + "action", + "org_id", + "created_at", + "user_agent" + ] }, { "action": "sso_redirect.disable", "description": "Automatic redirects for users to single sign-on (SSO) was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sso_redirect.enable", "description": "Automatic redirects for users to single sign-on (SSO) was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "staff.set_domain_token_expiration", "description": "The verification code expiry time for an organization or enterprise domain was set.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner_type", + "business_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "staff.unverify_domain", "description": "An organization or enterprise domain was unverified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "owner_type", + "owner", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "staff.verify_domain", "description": "An organization or enterprise domain was verified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "team.add_member", "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", + "fields": [ + "user_agent", + "org_id", + "user_id", + "team", + "user", + "@timestamp", + "actor_id", + "created_at", + "operation_type", + "_document_id", + "org", + "action", + "actor", + "programmatic_access_type" + ] }, { "action": "team.add_repository", "description": "A team was given access and permissions to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "team", + "action", + "operation_type", + "created_at", + "@timestamp", + "org", + "repo", + "actor_id", + "_document_id", + "repo_id", + "user_agent", + "org_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "team.change_parent_team", "description": "A child team was created or a child team's parent was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" + "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", + "fields": [ + "org", + "@timestamp", + "created_at", + "_document_id", + "team", + "action", + "operation_type", + "actor", + "actor_id", + "user_agent", + "org_id", + "programmatic_access_type" + ] }, { "action": "team.change_privacy", "description": "A team's privacy level was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility" + "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", + "fields": [ + "user_agent", + "org", + "action", + "team", + "created_at", + "operation_type", + "actor_id", + "org_id", + "@timestamp", + "actor", + "_document_id" + ] }, { "action": "team.create", "description": "A new team is created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "oauth_application_id", + "action", + "operation_type", + "@timestamp", + "org_id", + "user_agent", + "team", + "org", + "actor", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "team.demote_maintainer", "description": "A user was demoted from a team maintainer to a team member.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", + "fields": [ + "user_agent", + "actor", + "actor_id", + "team", + "org", + "org_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "team.destroy", "description": "A team was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "org", + "team", + "org_id", + "actor_id", + "actor", + "action", + "@timestamp", + "user_agent", + "operation_type", + "_document_id", + "programmatic_access_type" + ] }, { "action": "team_discussions.clear", "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "business_id", + "operation_type", + "@timestamp", + "user_agent", + "actor", + "actor_id", + "user", + "business", + "action", + "created_at", + "user_id", + "_document_id" + ] }, { "action": "team_discussions.disable", "description": "Team discussions were disabled for an organization.", - "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization" + "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization", + "fields": [ + "org_id", + "action", + "operation_type", + "actor", + "org", + "created_at", + "actor_id", + "user", + "user_id", + "@timestamp", + "user_agent", + "_document_id" + ] }, { "action": "team_discussions.enable", "description": "Team discussions were enabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "@timestamp", + "action", + "_document_id", + "user_agent", + "user_id", + "business_id", + "user", + "business", + "operation_type", + "actor", + "created_at" + ] }, { "action": "team.promote_maintainer", "description": "A user was promoted from a team member to a team maintainer.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", + "fields": [ + "user_agent", + "actor", + "actor_id", + "team", + "org", + "org_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "team.remove_member", "description": "An organization member was removed from a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", + "fields": [ + "operation_type", + "created_at", + "actor_id", + "org", + "org_id", + "team", + "user_id", + "actor", + "user", + "action", + "@timestamp", + "user_agent", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "repo", + "repo_id", + "action", + "_document_id", + "actor", + "@timestamp", + "actor_id", + "user_agent", + "created_at", + "team", + "org", + "operation_type", + "programmatic_access_type" + ] }, { "action": "team.rename", "description": "A team's name was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "name", + "user_agent", + "created_at", + "team", + "operation_type", + "actor_id", + "org", + "action", + "actor", + "org_id", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "team_sync_tenant.disabled", "description": "Team synchronization with a tenant was disabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "action", + "created_at", + "actor", + "org_id", + "actor_id", + "operation_type", + "_document_id", + "@timestamp", + "org", + "user_agent" + ] }, { "action": "team_sync_tenant.enabled", "description": "Team synchronization with a tenant was enabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "org_id", + "business_id", + "actor", + "created_at", + "user_agent", + "@timestamp", + "operation_type", + "business", + "actor_id", + "org", + "action", + "_document_id" + ] }, { "action": "team_sync_tenant.update_okta_credentials", "description": "The Okta credentials for team synchronization with a tenant were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "team", + "org_id", + "@timestamp", + "org", + "_document_id", + "old_permission", + "repo", + "action", + "repo_id", + "actor", + "operation_type", + "created_at", + "user_agent", + "permission", + "new_repo_permission", + "new_repo_base_role", + "old_repo_permission", + "old_repo_base_role", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "user_license.create", "description": "A seat license for a user in an enterprise was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "business_id", + "_document_id", + "business", + "operation_type", + "@timestamp", + "created_at", + "action", + "user", + "user_agent", + "actor_id", + "oauth_application_id", + "actor" + ] }, { "action": "user_license.destroy", "description": "A seat license for a user in an enterprise was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "@timestamp", + "created_at", + "action", + "operation_type", + "_document_id", + "actor_id", + "business", + "business_id", + "user_agent", + "actor", + "user_id" + ] }, { "action": "user_license.update", "description": "A seat license type for a user in an enterprise was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "business_id", + "business", + "user", + "user_id", + "@timestamp", + "operation_type", + "created_at", + "action", + "_document_id" + ] }, { "action": "vulnerability_alert_rule.create", "description": "A Dependabot rule was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "vulnerability_alert_rule.delete", "description": "A Dependabot rule was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "vulnerability_alert_rule.disable", "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "vulnerability_alert_rule.enable", "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "vulnerability_alert_rule.force_disable", "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "action", + "org", + "org_id", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "vulnerability_alert_rule.force_enable", "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "action", + "org", + "org_id", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "vulnerability_alert_rule.update", "description": "A Dependabot rule's conditions, actions, or metadata changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "user_agent", + "actor", + "actor_id", + "workflow_run_id", + "run_number", + "user", + "user_id", + "repo", + "repo_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "workflow_run_id", + "run_number", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "workflows.cancel_workflow_run", "description": "A workflow run was cancelled.", - "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow" + "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "started_at", + "event", + "name", + "workflow_run_id", + "head_branch", + "head_sha", + "run_number", + "cancelled_at", + "workflow_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "business", + "business_id", + "trigger_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "token_id", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "workflow_run_id", + "run_number", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "workflows.completed_workflow_run", "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history" + "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "started_at", + "event", + "name", + "workflow_run_id", + "head_branch", + "head_sha", + "completed_at", + "conclusion", + "run_number", + "workflow_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "business", + "business_id", + "trigger_id", + "run_attempt", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "workflows.created_workflow_run", "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow" + "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "started_at", + "event", + "name", + "workflow_run_id", + "head_branch", + "head_sha", + "workflow_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "business", + "business_id", + "trigger_id", + "public_repo", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "workflow_run_id", + "started_at", + "head_branch", + "head_sha", + "trigger_id", + "programmatic_access_type" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "workflow_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "workflow_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "workflows.prepared_workflow_job", "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows" + "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", + "fields": [ + "repo_id", + "repo", + "org_id", + "org", + "business_id", + "business", + "workflow_run_id", + "job_name", + "runner_labels", + "is_hosted_runner", + "environment_name", + "secrets_passed", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp", + "runner_owner_type", + "job_workflow_ref", + "calling_workflow_refs", + "calling_workflow_shas", + "imposer_repo" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "user_agent", + "actor", + "actor_id", + "workflow_run_id", + "run_number", + "user", + "user_id", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "workflows.rerun_workflow_run", "description": "A workflow run was re-run.", - "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs" + "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "started_at", + "event", + "name", + "workflow_run_id", + "head_branch", + "head_sha", + "run_number", + "workflow_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "business", + "business_id", + "trigger_id", + "run_attempt", + "rerun_type", + "check_run_id", + "programmatic_access_type", + "actor_is_bot" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghec/organization.json b/src/audit-logs/data/ghec/organization.json index 6688037011e3..864af99a4037 100644 --- a/src/audit-logs/data/ghec/organization.json +++ b/src/audit-logs/data/ghec/organization.json @@ -2,3211 +2,13140 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "@timestamp", + "operation_type", + "user_agent", + "_document_id", + "created_at", + "action", + "actor", + "actor_id", + "org_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "actor", + "operation_type", + "_document_id", + "user_agent", + "created_at", + "actor_id", + "@timestamp", + "user", + "action", + "user_id", + "programmatic_access_type" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "user_id", + "user", + "repo_id", + "repo", + "org", + "org_id", + "actions_cache_id", + "actions_cache_key", + "actions_cache_version", + "actions_cache_scope", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "advisory_credit.accept", "description": "Credit was accepted for a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", + "fields": [ + "user_agent", + "actor", + "actor_id", + "ghsa_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "advisory_credit.create", "description": "Someone was added to the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "ghsa_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "advisory_credit.decline", "description": "Credit was declined for a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "ghsa_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "advisory_credit.destroy", "description": "Someone was removed from the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "ghsa_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "actor", + "user_agent", + "actor_id", + "repo", + "repo_id", + "@timestamp", + "created_at", + "_document_id", + "operation_type", + "programmatic_access_type" + ] }, { "action": "auto_approve_personal_access_token_requests.disable", "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "auto_approve_personal_access_token_requests.enable", "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "actor_id", + "user", + "@timestamp", + "actor", + "user_id", + "action", + "created_at", + "operation_type", + "_document_id", + "user_agent" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "actor", + "operation_type", + "actor_id", + "org_id", + "@timestamp", + "user_agent", + "created_at", + "_document_id", + "org", + "email", + "action" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "oauth_application_id", + "@timestamp", + "actor_id", + "operation_type", + "_document_id", + "actor", + "user", + "user_id", + "user_agent", + "created_at", + "action" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user", + "operation_type", + "user_agent", + "created_at", + "user_id", + "actor", + "action", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "visibility", + "user_agent", + "user", + "@timestamp", + "repo", + "actor_id", + "user_id", + "action", + "created_at", + "actor", + "operation_type", + "repo_id", + "_document_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "actor", + "actor_id", + "operation_type", + "repo_id", + "action", + "created_at", + "_document_id", + "user_agent", + "repo", + "programmatic_access_type" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "origin_repository", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.attempted_to_create_from_prebuild", "description": "An attempt to create a codespace from a prebuild was made.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "owner", + "pull_request_id", + "user_id", + "user", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "codespaces.business_enablement_updated", "description": "Enterprise setting for Codespaces ownership was updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "enablement", + "organization_names", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "user_id", + "org_id", + "owner", + "name", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot", + "machine_type", + "devcontainer_path" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "owner", + "name", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot", + "machine_type", + "devcontainer_path" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "owner", + "name", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "owner", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "codespaces.policy_group_created", "description": "Policies were applied to codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.policy_group_deleted", "description": "Policies were removed from codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "codespaces.policy_group_updated", "description": "Policies were updated for codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.start_environment", "description": "A codespace was started.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "org", + "owner", + "pull_request_id", + "machine_type", + "user_id", + "user", + "devcontainer_path", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "user_agent", + "actor", + "actor_id", + "business", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "commit_comment.destroy", "description": "A commit comment was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "repo", + "org", + "org_id", + "created_at", + "@timestamp", + "operation_type", + "repo_id", + "actor_id", + "_document_id", + "user_agent", + "action", + "programmatic_access_type" + ] }, { "action": "commit_comment.update", "description": "A commit comment was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "repo_id", + "actor", + "org", + "action", + "@timestamp", + "repo", + "org_id", + "actor_id", + "created_at", + "user_agent", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "copilot.access_revoked", "description": "The user's Copilot access was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "reason", + "plan", + "org_id", + "owner", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.cfb_org_settings_changed", "description": "Settings for Copilot Business were changed at the organization level.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.cfb_seat_added", "description": "A seat was added to the Copilot Business subscription for a user and they have received access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "token_id", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_assignment_created", "description": "A seat assignment was newly created for a user.", - "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business" + "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", + "fields": [ + "actor", + "actor_id", + "user_agent", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.cfb_seat_assignment_refreshed", "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_assignment_reused", "description": "A seat assignment was re-created for a user who already had a seat with no pending cancellation date.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.cfb_seat_assignment_unassigned", "description": "A seat was unassigned from a user and they will lose access to GitHub Copilot at the end of the billing cycle.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_cancelled", "description": "A seat was canceled from the Copilot Business subscription and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "seat_assignment" + ] }, { "action": "copilot.cfb_seat_cancelled_by_staff", "description": "A seat was canceled from the Copilot Business subscription manually by GitHub and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user_id", + "user", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_management_changed", "description": "The seat management setting was changed for the Copilot Business subscription.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "old_value", + "new_value", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "copilot.content_exclusion_changed", "description": "The excluded paths for GitHub Copilot were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "excluded_paths", + "owner_type", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.knowledge_base_created", "description": "A knowledge base was created in the organization.", - "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases" + "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases", + "fields": [ + "actor", + "actor_id", + "user_agent", + "knowledge_base_name", + "org_id", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "copilot.knowledge_base_deleted", "description": "A knowledge base was deleted from the organization.", - "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases" + "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases", + "fields": [ + "actor", + "actor_id", + "user_agent", + "knowledge_base_name", + "org_id", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "copilot.knowledge_base_updated", "description": "A knowledge base was updated in the organization.", - "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases" + "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases", + "fields": [ + "actor", + "actor_id", + "user_agent", + "knowledge_base_name", + "org_id", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "custom_property_definition.create", "description": "A new custom property definition was created.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "property_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "value_type", + "required", + "default_value", + "definition_id" + ] }, { "action": "custom_property_definition.destroy", "description": "A custom property definition was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "property_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "value_type", + "required", + "default_value", + "definition_id", + "allowed_values" + ] }, { "action": "custom_property_definition.update", "description": "A custom property definition was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "property_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "value_type", + "required", + "default_value", + "old_allowed_values", + "allowed_values", + "definition_id", + "old_required", + "old_default_value", + "old_value_type", + "old_values_editable_by", + "values_editable_by" + ] }, { "action": "custom_property_value.create", "description": "A repository's custom property value was manually set for the first time.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "definition_id", + "property_name", + "value", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "custom_property_value.destroy", "description": "A repository's custom property value was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "custom_property_value.update", "description": "A repository's custom property value was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "definition_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "discussion_comment.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "org", + "repo_id", + "action", + "actor", + "org_id", + "_document_id", + "actor_id", + "operation_type", + "@timestamp", + "created_at", + "user_agent", + "programmatic_access_type" + ] }, { "action": "discussion_comment.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "@timestamp", + "actor", + "user_agent", + "org", + "_document_id", + "actor_id", + "operation_type", + "created_at", + "repo", + "org_id", + "action" + ] }, { "action": "discussion.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "user_agent", + "actor_id", + "org_id", + "actor", + "org", + "action", + "operation_type", + "@timestamp", + "title", + "_document_id", + "created_at", + "repo", + "programmatic_access_type" + ] }, { "action": "discussion_post.destroy", "description": "Triggered when a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "team", + "created_at", + "user_id", + "@timestamp", + "number", + "org", + "title", + "actor", + "actor_id", + "user", + "action", + "user_agent", + "operation_type", + "_document_id" + ] }, { "action": "discussion_post_reply.destroy", "description": "Triggered when a reply to a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "actor_id", + "action", + "@timestamp", + "user_agent", + "operation_type", + "user_id", + "actor", + "number", + "user", + "created_at", + "_document_id" + ] }, { "action": "discussion_post_reply.update", "description": "Triggered when a reply to a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "action", + "_document_id", + "org", + "@timestamp", + "actor_id", + "operation_type", + "user", + "user_id", + "org_id", + "user_agent", + "actor", + "number", + "team", + "created_at" + ] }, { "action": "discussion_post.update", "description": "Triggered when a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "created_at", + "_document_id", + "title", + "user", + "user_agent", + "org", + "operation_type", + "actor_id", + "@timestamp", + "actor", + "team", + "action", + "org_id", + "user_id", + "number" + ] }, { "action": "enterprise_installation.create", "description": "The GitHub App associated with a GitHub Connect connection was created.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "created_at", + "operation_type", + "@timestamp", + "_document_id", + "org_id", + "action", + "org", + "actor_id", + "user_agent", + "actor" + ] }, { "action": "enterprise_installation.destroy", "description": "The GitHub App associated with a GitHub Connect connection was deleted.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "created_at", + "_document_id", + "action", + "@timestamp", + "actor_id", + "actor", + "user_agent", + "org", + "operation_type", + "org_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "environment_name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "environment_name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "public_repo", + "token_scopes" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "environment_name", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "environment_name", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "git.clone", "description": "A repository was cloned.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "transport_protocol", + "repository", + "repository_public", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "user", + "user_id", + "transport_protocol_name" + ] }, { "action": "git.fetch", "description": "Changes were fetched from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "transport_protocol", + "repository", + "repository_public", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "user", + "user_id", + "transport_protocol_name" + ] }, { "action": "git.push", "description": "Changes were pushed to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "transport_protocol", + "repository", + "repository_public", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "user", + "user_id", + "transport_protocol_name" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "runner_group_id", + "business", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "business", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "runner_group_id", + "business", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "name", + "events", + "active", + "active_was", + "hook_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "name", + "org", + "user_agent", + "hook_id", + "repo", + "repo_id", + "created_at", + "oauth_application_id", + "action", + "events", + "org_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "oauth_application", + "_document_id", + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "repo_id", + "hook_id", + "events", + "repo", + "@timestamp", + "operation_type", + "name", + "action", + "created_at", + "org_id", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "events", + "repo", + "created_at", + "org", + "name", + "actor_id", + "repo_id", + "org_id", + "action", + "operation_type", + "oauth_application_id", + "user_agent", + "hook_id", + "@timestamp", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "events", + "repo", + "operation_type", + "action", + "_document_id", + "actor_id", + "name", + "events_were", + "@timestamp", + "created_at", + "hook_id", + "repo_id", + "org_id", + "org", + "user_agent", + "oauth_application_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "action", + "operation_type", + "@timestamp", + "actor", + "user_agent", + "actor_id", + "name", + "user_id", + "_document_id", + "integration", + "created_at", + "programmatic_access_type" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "user_id", + "actor_id", + "@timestamp", + "name", + "integration", + "user", + "_document_id", + "action", + "operation_type", + "created_at", + "user_agent" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "operation_type", + "@timestamp", + "name", + "repository_selection", + "user_id", + "action", + "user_agent", + "user", + "created_at", + "integration", + "_document_id", + "programmatic_access_type" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "actor", + "created_at", + "_document_id", + "repository_selection", + "integration", + "user_id", + "user", + "action", + "operation_type", + "name", + "actor_id", + "user_agent", + "programmatic_access_type" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "user_id", + "repository_selection", + "name", + "user", + "integration", + "operation_type", + "actor_id", + "action", + "repositories_added", + "created_at", + "_document_id", + "@timestamp", + "actor", + "user_agent", + "token_scopes", + "repositories_added_names", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "user", + "operation_type", + "user_agent", + "actor", + "repository_selection", + "repositories_removed", + "integration", + "user_id", + "created_at", + "_document_id", + "@timestamp", + "name", + "action", + "actor_id", + "repositories_removed_names", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "integration_installation_request.close", "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "url", + "actor", + "actor_id", + "created_at", + "operation_type", + "@timestamp", + "integration", + "action", + "user_agent", + "reason", + "_document_id", + "org", + "org_id" + ] }, { "action": "integration_installation_request.create", "description": "A member requested that an owner install a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "@timestamp", + "actor_id", + "org", + "_document_id", + "action", + "user_agent", + "created_at", + "url", + "org_id", + "operation_type", + "actor", + "integration" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "user_agent", + "name", + "repository_selection", + "actor_id", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "user_agent", + "name", + "repository_selection", + "actor_id", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "integration", + "user_id", + "user_agent", + "name", + "user", + "operation_type", + "actor_id", + "action", + "_document_id", + "created_at", + "repository_selection", + "@timestamp", + "actor" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "created_at", + "action", + "_document_id", + "name", + "org_id", + "manager", + "operation_type", + "actor", + "integration", + "org", + "@timestamp", + "actor_id", + "user_agent" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "user_agent", + "actor_id", + "org", + "operation_type", + "integration", + "org_id", + "_document_id", + "action", + "actor", + "name", + "created_at", + "manager", + "@timestamp" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation" + "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "integration", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "user_id", + "name", + "user", + "action", + "actor_id", + "created_at", + "_document_id", + "user_agent", + "operation_type", + "actor", + "integration" + ] }, { "action": "integration.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation" + "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "integration", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "ip_allow_list.disable", "description": "An IP allow list was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "actor", + "org", + "user_agent", + "_document_id", + "user_id", + "actor_id", + "created_at", + "org_id", + "action", + "@timestamp", + "user" + ] }, { "action": "ip_allow_list.disable_for_installed_apps", "description": "An IP allow list was disabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "ip_allow_list.enable", "description": "An IP allow list was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "business", + "user_id", + "actor", + "user", + "business_id", + "_document_id", + "action", + "@timestamp", + "user_agent", + "actor_id", + "operation_type", + "org", + "created_at" + ] }, { "action": "ip_allow_list.enable_for_installed_apps", "description": "An IP allow list was enabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "ip_allow_list_entry.create", "description": "An IP address was added to an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "active", + "org", + "ip_allow_list_entry", + "@timestamp", + "_document_id", + "operation_type", + "created_at", + "user_agent", + "action", + "actor_id", + "business_id", + "org_id", + "business", + "actor", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "ip_allow_list_entry.destroy", "description": "An IP address was deleted from an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "ip_allow_list_entry", + "org", + "operation_type", + "created_at", + "active", + "action", + "@timestamp", + "business", + "business_id", + "user_agent", + "org_id", + "actor", + "actor_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "ip_allow_list_entry.update", "description": "An IP address or its description was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "actor", + "org", + "action", + "operation_type", + "created_at", + "user_agent", + "actor_id", + "ip_allow_list_entry", + "active", + "org_id", + "@timestamp" + ] }, { "action": "issue_comment.destroy", "description": "A comment on an issue was deleted from the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "org", + "repo", + "actor_id", + "@timestamp", + "created_at", + "_document_id", + "action", + "operation_type", + "user_agent", + "repo_id", + "actor", + "oauth_application_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "org", + "action", + "repo_id", + "org_id", + "created_at", + "operation_type", + "@timestamp", + "user_agent", + "_document_id", + "actor_id", + "actor", + "oauth_application_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "issue.destroy", "description": "An issue was deleted from the repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue" + "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", + "fields": [ + "user", + "actor_id", + "created_at", + "title", + "@timestamp", + "_document_id", + "actor", + "user_id", + "action", + "operation_type", + "user_agent", + "repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "issue.pinned", "description": "An issue was pinned to a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "_document_id", + "user_agent", + "actor_id", + "created_at", + "action", + "actor", + "operation_type", + "owner_type", + "@timestamp", + "repo_id", + "number", + "repo", + "event", + "user", + "user_id" + ] }, { "action": "issue.transfer", "description": "An issue was transferred to another repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", + "fields": [ + "user", + "user_id", + "@timestamp", + "user_agent", + "owner_type", + "actor_id", + "number", + "repo", + "operation_type", + "_document_id", + "repo_id", + "action", + "created_at", + "actor", + "programmatic_access_type" + ] }, { "action": "issue.unpinned", "description": "An issue was unpinned from a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "event", + "user_agent", + "actor_id", + "repo_id", + "actor", + "action", + "created_at", + "repo", + "operation_type", + "_document_id", + "number", + "owner_type", + "@timestamp", + "user", + "user_id", + "token_scopes" + ] }, { "action": "issues.deletes_disabled", "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "user_agent", + "action", + "@timestamp", + "operation_type", + "actor_id", + "user_id", + "created_at", + "_document_id", + "actor", + "user", + "org", + "org_id" + ] }, { "action": "issues.deletes_enabled", "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "actor", + "@timestamp", + "created_at", + "user_agent", + "operation_type" + ] }, { "action": "issues.deletes_policy_cleared", "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "user", + "actor", + "business_id", + "action", + "operation_type", + "user_agent", + "created_at", + "@timestamp", + "_document_id", + "business", + "user_id", + "actor_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "@timestamp", + "_document_id", + "user_agent", + "operation_type", + "created_at", + "action", + "user", + "user_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "secondary_category", + "actor", + "primary_category", + "user", + "@timestamp", + "_document_id", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_id", + "marketplace_listing", + "integration", + "action" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "primary_category", + "user_agent", + "actor", + "marketplace_listing", + "@timestamp", + "integration", + "org_id", + "action", + "org", + "secondary_category", + "operation_type", + "created_at", + "actor_id", + "_document_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "primary_category", + "_document_id", + "user", + "created_at", + "user_agent", + "oauth_application", + "action", + "marketplace_listing", + "user_id", + "secondary_category", + "oauth_application_id", + "actor", + "actor_id", + "operation_type", + "@timestamp" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "actor", + "actor_id", + "user_agent", + "org_id", + "created_at", + "secondary_category", + "operation_type", + "marketplace_listing", + "action", + "@timestamp", + "_document_id", + "primary_category", + "integration" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "secondary_category", + "oauth_application_id", + "@timestamp", + "action", + "user_agent", + "user_id", + "operation_type", + "oauth_application", + "actor", + "created_at", + "marketplace_listing", + "actor_id", + "primary_category", + "user" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "primary_category", + "secondary_category", + "marketplace_listing", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "members_can_create_pages.disable", "description": "The ability for members to publish GitHub Pages sites was disabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "members_can_create_pages.enable", "description": "The ability for members to publish GitHub Pages sites was enabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "members_can_create_private_pages.disable", "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "members_can_create_private_pages.enable", "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "members_can_create_public_pages.disable", "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "members_can_create_public_pages.enable", "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "members_can_delete_repos.clear", "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "_document_id", + "user", + "user_id", + "business", + "operation_type", + "user_agent", + "actor", + "actor_id", + "business_id", + "@timestamp", + "created_at", + "action" + ] }, { "action": "members_can_delete_repos.disable", "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "org", + "_document_id", + "actor_id", + "user", + "user_id", + "user_agent", + "actor", + "operation_type", + "org_id", + "action", + "@timestamp", + "created_at" + ] }, { "action": "members_can_delete_repos.enable", "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "action", + "org_id", + "user_id", + "business", + "actor_id", + "@timestamp", + "_document_id", + "user", + "business_id", + "created_at", + "actor", + "org", + "operation_type", + "user_agent" + ] }, { "action": "members_can_view_dependency_insights.clear", "description": "An enterprise owner cleared the policy setting for viewing dependency insights in any organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "user", + "user_id", + "business", + "business_id", + "created_at", + "actor", + "action", + "operation_type" + ] }, { "action": "members_can_view_dependency_insights.disable", "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "business", + "created_at", + "user_id", + "business_id", + "user", + "org", + "operation_type", + "actor", + "_document_id", + "action", + "user_agent", + "actor_id", + "org_id", + "@timestamp" + ] }, { "action": "members_can_view_dependency_insights.enable", "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "created_at", + "_document_id", + "user_agent", + "user", + "user_id", + "business", + "business_id", + "operation_type", + "@timestamp", + "action", + "actor", + "actor_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "max_entries_to_build", + "min_entries_to_merge", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "@timestamp", + "_document_id", + "user_id", + "action", + "operation_type", + "created_at" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "action", + "org", + "created_at", + "operation_type", + "org_id", + "@timestamp", + "_document_id", + "user_agent", + "actor" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "org_id", + "_document_id", + "org", + "repo_id", + "action", + "actor", + "created_at", + "operation_type", + "@timestamp", + "user_agent", + "actor_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "migration.destroy_file", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "@timestamp", + "org_id", + "action", + "operation_type", + "created_at", + "repo", + "_document_id", + "repo_id" + ] }, { "action": "migration.download", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "org_id", + "oauth_application_id", + "repo_id", + "operation_type", + "@timestamp", + "user_agent", + "created_at", + "org", + "action", + "_document_id", + "repo", + "actor", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "org", + "created_at", + "oauth_application_id", + "operation_type", + "user_agent", + "actor_id", + "org_id", + "action", + "actor", + "oauth_application", + "@timestamp", + "_document_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "created_at", + "oauth_application_id", + "user_id", + "operation_type", + "@timestamp", + "user_agent", + "oauth_application", + "_document_id", + "actor", + "actor_id", + "action", + "user" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user", + "user_id", + "action", + "oauth_application", + "operation_type", + "actor_id", + "_document_id", + "created_at", + "actor", + "oauth_application_id", + "@timestamp", + "user_agent" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "oauth_application_id", + "oauth_application", + "actor_id", + "user_agent", + "@timestamp", + "user_id", + "action", + "_document_id", + "actor", + "user", + "created_at", + "operation_type" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "actor", + "operation_type", + "created_at", + "user_agent", + "oauth_application", + "actor_id", + "oauth_application_id", + "@timestamp", + "user_id", + "_document_id", + "user", + "action" + ] }, { "action": "org.accept_business_invitation", "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.add_billing_manager", "description": "A billing manager was added to an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", + "fields": [ + "operation_type", + "_document_id", + "user_agent", + "org", + "user_id", + "action", + "created_at", + "org_id", + "user", + "actor", + "actor_id", + "@timestamp" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "permission", + "_document_id", + "org", + "operation_type", + "actor", + "user", + "@timestamp", + "created_at", + "user_agent", + "org_id", + "user_id", + "actor_id", + "action", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "inviter", + "org", + "org_id", + "repo", + "repo_id", + "public_repo", + "permission", + "invitee", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.add_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org_id", + "org", + "team", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "org.advanced_security_policy_selected_member_disabled", "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "org.advanced_security_policy_selected_member_enabled", "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "org.allow_third_party_access_requests_from_outside_collaborators_disabled", "description": "Third-party application access for outside collaborators was disabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled", "description": "Third-party application access for outside collaborators was enabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.archive", "description": "The organization was archived.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.audit_log_export", "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", + "fields": [ + "org_id", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "org", + "action", + "created_at", + "user_agent", + "actor_id" + ] }, { "action": "org.audit_log_git_event_export", "description": "An export of the organization's Git events was created.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "start", + "end", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "business", + "business_id" + ] }, { "action": "org.billing_signup_error", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "user_agent", + "action", + "@timestamp", + "actor_id", + "org_id", + "_document_id", + "actor", + "org", + "operation_type" + ] }, { "action": "org.block_user", "description": "An organization owner blocked a user from accessing the organization's repositories.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", + "fields": [ + "actor", + "user_agent", + "org_id", + "created_at", + "_document_id", + "blocked_user", + "action", + "operation_type", + "actor_id", + "org", + "@timestamp" + ] }, { "action": "org.cancel_business_invitation", "description": "An invitation for an organization to join an enterprise was revoked", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.cancel_invitation", "description": "An invitation sent to a user to join an organization was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "org_id", + "email", + "@timestamp", + "actor", + "action", + "operation_type", + "user_agent", + "org", + "_document_id", + "created_at", + "invitee_email", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "org.clear_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.codeql_enabled", "description": "Code scanning using the default setup was enabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.codespaces_access_updated", "description": "Access to use Codespaces on internal and private repositories was updated for an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "enablement", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.codespaces_ownership_updated", "description": "Ownership and payment for codespaces was updated for an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "owner_type", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.codespaces_team_access_allowed", "description": "A team has been allowed to use Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "team", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.codespaces_team_access_revoked", "description": "A team has been prevented from using Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "team", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.codespaces_user_access_allowed", "description": "A user has been allowed to use Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.codespaces_user_access_revoked", "description": "A user has been prevented from using Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.config.disable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "org", + "action", + "operation_type", + "_document_id", + "actor", + "actor_id", + "@timestamp", + "user_agent", + "org_id", + "created_at" + ] }, { "action": "org.config.disable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "operation_type", + "@timestamp", + "created_at", + "user_agent", + "action", + "actor_id", + "org", + "_document_id", + "actor", + "org_id" + ] }, { "action": "org.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "_document_id", + "operation_type", + "actor_id", + "org_id", + "action", + "created_at", + "actor", + "org", + "@timestamp", + "user_agent" + ] }, { "action": "org.config.enable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "created_at", + "_document_id", + "actor_id", + "actor", + "org", + "org_id", + "operation_type", + "action", + "user_agent" + ] }, { "action": "org.config.enable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "actor", + "actor_id", + "org_id", + "action", + "operation_type", + "@timestamp", + "user_agent", + "org", + "created_at", + "_document_id" + ] }, { "action": "org.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "actor_id", + "action", + "created_at", + "user_agent", + "actor", + "_document_id", + "org_id", + "operation_type", + "org", + "@timestamp" + ] }, { "action": "org.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.confirm_business_invitation", "description": "An invitation for an organization to join an enterprise was confirmed.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.connect_usage_metrics_export", "description": "Server statistics were exported for the organization.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.create", "description": "An organization was created.", - "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" + "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", + "fields": [ + "org", + "actor_id", + "actor", + "action", + "@timestamp", + "_document_id", + "user_agent", + "operation_type", + "org_id", + "created_at" + ] }, { "action": "org.create_actions_secret", "description": "A GitHub Actions secret was created for an organization.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.create_integration_secret", "description": "An integration secret was created for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "visibility", + "integration", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "org_credential_authorization.deauthorize", "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", + "fields": [ + "user_agent", + "operation_type", + "created_at", + "actor_id", + "org_id", + "business", + "action", + "@timestamp", + "org", + "_document_id", + "business_id", + "actor", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "org_credential_authorization.grant", "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", + "fields": [ + "user_agent", + "actor", + "@timestamp", + "created_at", + "org_id", + "business_id", + "operation_type", + "_document_id", + "action", + "actor_id", + "business", + "org", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "org_credential_authorization.revoke", "description": "An owner revoked authorized credentials.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", + "fields": [ + "actor", + "org", + "@timestamp", + "owner", + "oauth_application_id", + "org_id", + "operation_type", + "action", + "business", + "created_at", + "business_id", + "actor_id", + "_document_id", + "user_agent" + ] }, { "action": "org.disable_member_team_creation_permission", "description": "Team creation was limited to owners.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "actor", + "@timestamp", + "_document_id", + "user", + "user_id", + "action", + "created_at", + "actor_id", + "user_agent", + "org", + "org_id", + "operation_type" + ] }, { "action": "org.disable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were disabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "actor_id", + "org_id", + "action", + "_document_id", + "@timestamp", + "actor", + "org", + "operation_type", + "user_agent", + "created_at" + ] }, { "action": "org.disable_reader_discussion_creation_permission", "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.disable_saml", "description": "SAML single sign-on was disabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "sso_url", + "issuer", + "action", + "@timestamp", + "_document_id", + "created_at", + "org", + "operation_type" + ] }, { "action": "org.disable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the organization was disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.disable_two_factor_requirement", "description": "A two-factor authentication requirement was disabled for the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "org", + "org_id", + "action", + "actor", + "actor_id", + "operation_type", + "@timestamp", + "_document_id", + "user_agent" + ] }, { "action": "org.display_commenter_full_name_disabled", "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "user_id", + "user", + "action", + "operation_type", + "@timestamp", + "_document_id", + "created_at", + "user_agent", + "org", + "actor_id", + "org_id" + ] }, { "action": "org.display_commenter_full_name_enabled", "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "user_agent", + "actor", + "_document_id", + "user_id", + "operation_type", + "@timestamp", + "created_at", + "user", + "action", + "actor_id", + "org_id" + ] }, { "action": "org.enable_member_team_creation_permission", "description": "Team creation by members was allowed.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "org_id", + "user", + "actor", + "operation_type", + "_document_id", + "user_id", + "created_at", + "user_agent", + "actor_id", + "org", + "action", + "@timestamp" + ] }, { "action": "org.enable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were enabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "actor_id", + "operation_type", + "org", + "created_at", + "_document_id", + "actor", + "org_id", + "action", + "user_agent", + "@timestamp" + ] }, { "action": "org.enable_reader_discussion_creation_permission", "description": "An organization owner allowed users with read access to create discussions in an organization", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "org", + "org_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "org.enable_saml", "description": "SAML single sign-on was enabled for the organization.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", + "fields": [ + "actor_id", + "action", + "operation_type", + "actor", + "sso_url", + "org", + "created_at", + "@timestamp", + "issuer", + "org_id", + "_document_id", + "user_agent" + ] }, { "action": "org.enable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the organization was enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.enable_two_factor_requirement", "description": "Two-factor authentication is now required for the organization.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "actor_id", + "action", + "_document_id", + "org", + "@timestamp", + "actor", + "user_agent", + "org_id", + "operation_type", + "created_at" + ] }, { "action": "org.integration_manager_added", "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "org_id", + "manager", + "@timestamp", + "actor", + "operation_type", + "_document_id", + "actor_id", + "org", + "action", + "created_at" + ] }, { "action": "org.integration_manager_removed", "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "@timestamp", + "org", + "user_agent", + "action", + "actor", + "actor_id", + "manager", + "operation_type", + "created_at", + "_document_id" + ] }, { "action": "org.invite_member", "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", + "fields": [ + "org", + "user_id", + "org_id", + "user", + "action", + "operation_type", + "_document_id", + "actor", + "@timestamp", + "created_at", + "user_agent", + "actor_id", + "invitee_email", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "org.invite_to_business", "description": "An organization was invited to join an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "org_id", + "user_agent", + "actor_id", + "user_id", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "actor", + "user", + "action" + ] }, { "action": "org.oauth_app_access_approved", "description": "Access to an organization was granted for an OAuth App.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", + "fields": [ + "url", + "actor", + "user_agent", + "actor_id", + "operation_type", + "org_id", + "_document_id", + "org", + "action", + "created_at", + "@timestamp" + ] }, { "action": "org.oauth_app_access_blocked", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "url", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.oauth_app_access_denied", "description": "Access was disabled for an OAuth App that was previously approved.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", + "fields": [ + "url", + "created_at", + "org_id", + "action", + "@timestamp", + "_document_id", + "user_agent", + "org", + "operation_type", + "actor", + "actor_id" + ] }, { "action": "org.oauth_app_access_requested", "description": "An organization member requested that an owner grant an OAuth App access to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "operation_type", + "created_at", + "user_agent", + "actor_id", + "_document_id", + "url", + "org_id", + "action", + "@timestamp", + "org" + ] }, { "action": "org.oauth_app_access_unblocked", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "url", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.rate_limited_invites", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "created_at", + "org_id", + "action", + "actor", + "actor_id", + "user_agent", + "operation_type", + "_document_id", + "org" + ] }, { "action": "org.recovery_code_failed", "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", + "fields": [ + "actor", + "actor_id", + "user_agent", + "reason", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.recovery_code_used", "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.recovery_codes_downloaded", "description": "An organization owner downloaded the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.recovery_codes_generated", "description": "An organization owner generated the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.recovery_codes_printed", "description": "An organization owner printed the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.recovery_codes_viewed", "description": "An organization owner viewed the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", + "fields": [ + "actor", + "operation_type", + "@timestamp", + "_document_id", + "org", + "org_id", + "action", + "created_at", + "user_agent", + "actor_id", + "actor_is_bot" + ] }, { "action": "org.remove_actions_secret", "description": "A GitHub Actions secret was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.remove_billing_manager", "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "user_id", + "user_agent", + "org_id", + "user", + "action", + "_document_id", + "operation_type", + "@timestamp", + "actor", + "org", + "actor_id", + "created_at" + ] }, { "action": "org.remove_integration_secret", "description": "An integration secret was removed from an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "integration", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "actor_id", + "user_agent", + "actor", + "action", + "user_id", + "@timestamp", + "created_at", + "user", + "operation_type", + "org_id", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "org.remove_outside_collaborator", "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "user", + "org_id", + "created_at", + "@timestamp", + "action", + "operation_type", + "user_agent", + "_document_id", + "actor", + "actor_id", + "user_id", + "programmatic_access_type" + ] }, { "action": "org.remove_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org_id", + "org", + "team", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", + "fields": [ + "operation_type", + "org_id", + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "org", + "created_at", + "actor", + "action", + "programmatic_access_type" + ] }, { "action": "org.rename", "description": "An organization was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "_document_id", + "@timestamp", + "org", + "action", + "actor", + "old_login", + "org_id", + "actor_id", + "operation_type", + "created_at" + ] }, { "action": "org.required_workflow_create", "description": "Triggered when a required workflow is created.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.required_workflow_delete", "description": "Triggered when a required workflow is deleted.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.required_workflow_update", "description": "Triggered when a required workflow is updated.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.restore_member", "description": "An organization member was restored.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", + "fields": [ + "user", + "actor", + "user_id", + "_document_id", + "action", + "created_at", + "org_id", + "operation_type", + "@timestamp", + "user_agent", + "org", + "actor_id" + ] }, { "action": "org.revoke_external_identity", "description": "A member's linked identity was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", + "fields": [ + "actor", + "org", + "org_id", + "user", + "operation_type", + "user_id", + "@timestamp", + "action", + "actor_id", + "user_agent", + "_document_id", + "created_at" + ] }, { "action": "org.revoke_sso_session", "description": "A member's SAML session was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", + "fields": [ + "actor_id", + "created_at", + "user", + "action", + "operation_type", + "@timestamp", + "org", + "org_id", + "user_agent", + "actor", + "user_id", + "_document_id" + ] }, { "action": "org.runner_group_created", "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "programmatic_access_type" + ] }, { "action": "org.runner_group_removed", "description": "A self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.runner_group_renamed", "description": "A self-hosted runner group was renamed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "org.runner_group_runner_removed", "description": "The REST API was used to remove a self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "runner_group_id", + "runner_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "org.runner_group_runners_added", "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "org.runner_group_runners_updated", "description": "A runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "runner_group_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.runner_group_updated", "description": "The configuration of a self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "runner_group_name", + "runner_group_allow_public", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "programmatic_access_type" + ] }, { "action": "org.runner_group_visiblity_updated", "description": "The visibility of a self-hosted runner group was updated via the REST API.", - "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "runner_group_id", + "visibility", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "org_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org_secret_scanning_generic_secrets.disabled", "description": "Generic secrets have been disabled at the organization level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org_secret_scanning_generic_secrets.enabled", "description": "Generic secrets have been enabled at the organization level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_disabled", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_enabled", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_updated", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "org.secret_scanning_push_protection_disable", "description": "Push protection for secret scanning was disabled.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.secret_scanning_push_protection_enable", "description": "Push protection for secret scanning was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_disable", "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_enable", "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "org_id", + "org", + "runner_id", + "runner_name", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp" + ] }, { "action": "org.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "org_id", + "org", + "runner_id", + "runner_name", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp" + ] }, { "action": "org.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "org_id", + "runner_id", + "runner_name", + "source_version", + "target_version", + "runner_group_id", + "runner_group_name" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "policy", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "actor", + "actor_id", + "user_agent", + "policy", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "limit", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.set_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "_document_id", + "org_id", + "operation_type", + "actor", + "actor_id", + "@timestamp", + "created_at", + "org", + "action" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "policy", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "user_agent", + "actor", + "actor_id", + "org_id", + "@timestamp", + "org", + "issuer", + "business", + "operation_type", + "created_at", + "business_id", + "_document_id", + "actor_is_bot" + ] }, { "action": "org.transfer", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "actor", + "actor_id", + "user_agent", + "from_business", + "to_business", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.transfer_outgoing", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "business", + "business_id", + "from_business", + "to_business", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.unarchive", "description": "The organization was unarchived.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.unblock_user", "description": "A user was unblocked from an organization.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", + "fields": [ + "oauth_application_id", + "_document_id", + "blocked_user", + "action", + "operation_type", + "@timestamp", + "created_at", + "actor", + "actor_id", + "org", + "org_id", + "user_agent" + ] }, { "action": "org.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "created_at", + "key", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.update_actions_settings", "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "new_policy", + "updated_allowed_types", + "old_policy", + "updated_access_policy", + "programmatic_access_type" + ] }, { "action": "org.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.update_default_repository_permission", "description": "The default repository permission level for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "action", + "operation_type", + "created_at", + "org", + "org_id", + "@timestamp", + "user_agent", + "permission", + "actor_id", + "old_permission", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.update_integration_secret", "description": "An integration secret was updated for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "visibility", + "integration", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "org_id", + "created_at", + "_document_id", + "user", + "user_id", + "action", + "actor_id", + "old_permission", + "permission", + "actor", + "user_agent", + "operation_type", + "org" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "action", + "@timestamp", + "actor_id", + "permission", + "created_at", + "user_agent", + "org", + "org_id", + "_document_id", + "visibility", + "operation_type" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "actor_id", + "permission", + "action", + "org_id", + "actor", + "created_at", + "_document_id", + "business_id", + "operation_type", + "org", + "user_agent", + "business", + "@timestamp" + ] }, { "action": "org.update_new_repository_default_branch_setting", "description": "The name of the default branch was changed for new repositories in the organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.update_repo_self_hosted_runners_policy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "old_repo_runners_policy", + "new_repo_runners_policy", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.update_saml_provider_settings", "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "sso_url", + "actor_id", + "operation_type", + "@timestamp", + "issuer", + "org", + "_document_id", + "actor", + "org_id", + "created_at", + "action" + ] }, { "action": "org.update_terms_of_service", "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", - "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" + "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", + "fields": [ + "org_id", + "actor", + "actor_id", + "user_agent", + "operation_type", + "_document_id", + "org", + "action", + "@timestamp", + "created_at" + ] }, { "action": "organization_default_label.create", "description": "A default label was created for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", + "fields": [ + "actor_id", + "actor", + "org", + "org_id", + "operation_type", + "_document_id", + "action", + "created_at", + "@timestamp", + "user_agent" + ] }, { "action": "organization_default_label.destroy", "description": "A default label was deleted for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", + "fields": [ + "operation_type", + "actor", + "@timestamp", + "_document_id", + "actor_id", + "org_id", + "org", + "action", + "created_at", + "user_agent" + ] }, { "action": "organization_default_label.update", "description": "A default label was edited for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", + "fields": [ + "org", + "created_at", + "@timestamp", + "actor", + "action", + "user_agent", + "actor_id", + "org_id", + "operation_type", + "_document_id" + ] }, { "action": "organization_domain.approve", "description": "A domain was approved for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner_type", + "org_id", + "business_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "organization_domain.create", "description": "A domain was added to an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "created_at", + "_document_id", + "action", + "actor_id", + "operation_type", + "@timestamp", + "user_agent", + "actor" + ] }, { "action": "organization_domain.destroy", "description": "A domain was removed from an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", + "fields": [ + "action", + "@timestamp", + "_document_id", + "user_agent", + "actor", + "actor_id", + "operation_type", + "created_at" + ] }, { "action": "organization_domain.verify", "description": "A domain was verified for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "operation_type", + "@timestamp", + "user_agent", + "actor", + "action", + "created_at", + "_document_id", + "actor_id" + ] }, { "action": "organization_moderators.add_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "team", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "organization_moderators.add_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "organization_moderators.remove_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "team", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "organization_moderators.remove_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "programmatic_access_type" + ] }, { "action": "organization_projects_change.clear", "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "actor", + "business_id", + "@timestamp", + "actor_id", + "user", + "user_id", + "action", + "user_agent", + "_document_id", + "created_at", + "operation_type", + "business" + ] }, { "action": "organization_projects_change.disable", "description": "Organization projects were disabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "org_id", + "action", + "user", + "org", + "created_at", + "user_agent", + "actor_id", + "operation_type", + "@timestamp", + "actor", + "user_id", + "_document_id" + ] }, { "action": "organization_projects_change.enable", "description": "Organization projects were enabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "actor_id", + "org_id", + "created_at", + "user_id", + "org", + "@timestamp", + "_document_id", + "user_agent", + "actor", + "user", + "action", + "operation_type" + ] }, { "action": "organization_role.assign", "description": "An organization role was assigned to a user or team.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "actor", + "actor_id", + "user_agent", + "organization_role_id", + "organization_role_name", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "organization_role.create", "description": "A custom organization role was created in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "name", + "owner", + "role_permissions", + "base_role", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "organization_role.destroy", "description": "A custom organization role was deleted in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "name", + "owner", + "role_permissions", + "base_role", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "organization_role.revoke", "description": "A user or team was unassigned an organization role.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "actor", + "actor_id", + "user_agent", + "organization_role_id", + "organization_role_name", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "organization_role.update", "description": "A custom organization role was edited in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "name", + "owner", + "role_permissions", + "base_role", + "old_role_permissions", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "packages.package_deleted", "description": "An entire package was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "actor_id", + "actor", + "org", + "org_id", + "repo", + "repo_id", + "package", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "packages.package_published", "description": "A package was published or republished to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "actor", + "org", + "org_id", + "repo", + "repo_id", + "package", + "ecosystem", + "version_count", + "is_republished", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "packages.package_version_deleted", "description": "A specific package version was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "actor_id", + "actor", + "org", + "org_id", + "repo", + "repo_id", + "package", + "version", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "ecosystem", + "actor_is_bot" + ] }, { "action": "packages.package_version_published", "description": "A specific package version was published or republished to a package.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "ecosystem", + "package", + "version", + "actor_id", + "user_agent", + "is_republished", + "actor", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "owner_type", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "owner_type", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "owner_type", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "user", + "operation_type", + "user_id", + "_document_id", + "action", + "actor", + "actor_id", + "@timestamp", + "created_at" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "created_at", + "actor_id", + "@timestamp", + "user_id", + "action", + "operation_type", + "actor", + "_document_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "org_id", + "created_at", + "actor_id", + "@timestamp", + "action", + "actor", + "org", + "user_agent", + "_document_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "repository_selection", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "repository_selection", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "org", + "org_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "user", + "user_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user_programmatic_access_name", + "org", + "org_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "prebuild_configuration.create", "description": "A GitHub Codespaces prebuild configuration for a repository was created.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "user_agent", + "actor", + "actor_id", + "branch", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "prebuild_configuration.destroy", "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "user_agent", + "actor", + "actor_id", + "branch", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "prebuild_configuration.run_triggered", "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "user_agent", + "actor", + "actor_id", + "branch", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "prebuild_configuration.update", "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "user_agent", + "actor", + "actor_id", + "branch", + "org", + "org_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_repository_forking.clear", "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "user_id", + "action", + "operation_type", + "@timestamp", + "business_id", + "actor_id", + "user", + "business", + "actor", + "created_at", + "_document_id" + ] }, { "action": "private_repository_forking.disable", "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "created_at", + "actor_id", + "_document_id", + "actor", + "user", + "repo", + "action", + "user_agent", + "@timestamp", + "org", + "operation_type", + "user_id", + "org_id", + "programmatic_access_type" + ] }, { "action": "private_repository_forking.enable", "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user_id", + "operation_type", + "_document_id", + "action", + "@timestamp", + "repo", + "org", + "business", + "user_agent", + "actor", + "repo_id", + "user", + "org_id", + "created_at", + "business_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "user", + "actor_id", + "user_id", + "@timestamp", + "created_at", + "owner", + "action", + "_document_id", + "user_agent", + "actor", + "operation_type" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "actor", + "user_agent", + "operation_type", + "user", + "created_at", + "user_id", + "action", + "_document_id", + "@timestamp" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "org_id", + "user_agent", + "operation_type", + "@timestamp", + "created_at", + "repo_id", + "org", + "_document_id", + "action", + "actor", + "actor_id", + "repo" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user", + "_document_id", + "user_id", + "user_agent", + "@timestamp", + "actor_id", + "action", + "created_at", + "actor" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "actor_id", + "operation_type", + "actor", + "user_id", + "@timestamp", + "created_at", + "_document_id", + "user_agent", + "user" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "action", + "actor_id", + "org_id", + "user_agent", + "actor", + "operation_type", + "@timestamp", + "_document_id", + "created_at", + "org", + "repo" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "actor", + "actor_id", + "action", + "user_id", + "_document_id", + "user_agent", + "operation_type", + "user", + "@timestamp", + "created_at" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "created_at", + "actor_id", + "old_name", + "operation_type", + "@timestamp", + "repo", + "_document_id", + "user_agent", + "org_id", + "business_id", + "actor", + "repo_id", + "org", + "business" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "repo_id", + "operation_type", + "actor", + "action", + "created_at", + "actor_id", + "_document_id", + "@timestamp", + "user_agent", + "org", + "org_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "org", + "@timestamp", + "_document_id", + "operation_type", + "created_at", + "actor_id", + "action", + "org_id", + "user_agent" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "org_id", + "operation_type", + "org", + "actor_id", + "_document_id", + "team", + "@timestamp", + "action", + "user_agent", + "actor" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "operation_type", + "@timestamp", + "actor_id", + "user", + "user_agent", + "actor", + "created_at", + "org", + "_document_id", + "org_id", + "action", + "programmatic_access_type" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "protected_branch.authorized_users_teams", "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", + "fields": [ + "repo", + "action", + "org_id", + "user_agent", + "name", + "created_at", + "_document_id", + "operation_type", + "actor", + "repo_id", + "org", + "actor_id", + "oauth_application_id", + "@timestamp", + "programmatic_access_type" + ] }, { "action": "protected_branch.branch_allowances", "description": "A protected branch allowance was given to a specific user, team or integration.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "token_id", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "name", + "authorized_actors", + "policy", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "protected_branch.create", "description": "Branch protection was enabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "repo_id", + "user_id", + "@timestamp", + "user_agent", + "repo", + "name", + "org_id", + "user", + "_document_id", + "actor", + "actor_id", + "org", + "action", + "created_at", + "authorized_actor_names", + "token_scopes", + "required_deployments_enforcement_level", + "merge_queue_enforcement_level", + "create_protected" + ] }, { "action": "protected_branch.destroy", "description": "Branch protection was disabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "name", + "repo", + "@timestamp", + "actor", + "org", + "actor_id", + "repo_id", + "org_id", + "operation_type", + "action", + "user_agent", + "created_at", + "_document_id", + "token_scopes", + "required_deployments_enforcement_level", + "merge_queue_enforcement_level", + "create_protected" + ] }, { "action": "protected_branch.dismiss_stale_reviews", "description": "Enforcement of dismissing stale pull requests was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "dismiss_stale_reviews_on_push", + "org_id", + "action", + "created_at", + "_document_id", + "@timestamp", + "actor_id", + "repo_id", + "operation_type", + "actor", + "repo", + "org", + "name", + "programmatic_access_type" + ] }, { "action": "protected_branch.dismissal_restricted_users_teams", "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "repo_id", + "actor", + "oauth_application_id", + "authorized_actors_only", + "authorized_actors", + "created_at", + "user_agent", + "name", + "_document_id", + "org_id", + "@timestamp", + "actor_id", + "org", + "action", + "operation_type", + "programmatic_access_type" + ] }, { "action": "protected_branch.policy_override", "description": "A branch protection requirement was overridden by a repository administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "created_at", + "actor", + "reasons", + "@timestamp", + "before", + "after", + "actor_id", + "repo", + "operation_type", + "user_agent", + "branch", + "overridden_codes", + "org", + "org_id", + "action", + "_document_id", + "referrer", + "business", + "business_id", + "deploy_key_fingerprint", + "token_scopes", + "programmatic_access_type", + "compliant_pull_request_ids" + ] }, { "action": "protected_branch.rejected_ref_update", "description": "A branch update attempt was rejected.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "org", + "@timestamp", + "created_at", + "_document_id", + "business", + "org_id", + "operation_type", + "repo_id", + "actor", + "branch", + "action", + "actor_id", + "business_id", + "deploy_key_fingerprint", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "protected_branch.update_admin_enforced", "description": "Branch protection was enforced for repository administrators.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "admin_enforced", + "operation_type", + "user_agent", + "actor", + "org", + "name", + "repo", + "@timestamp", + "action", + "repo_id", + "org_id", + "_document_id", + "created_at", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_allow_deletions_enforcement_level", "description": "Branch deletion was enabled or disabled for a protected branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "name", + "operation_type", + "repo", + "@timestamp", + "org_id", + "org", + "action", + "allow_deletions_enforcement_level", + "_document_id", + "created_at", + "actor_id", + "user_agent", + "actor", + "repo_id" + ] }, { "action": "protected_branch.update_allow_force_pushes_enforcement_level", "description": "Force pushes were enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "actor_id", + "name", + "_document_id", + "actor", + "repo", + "operation_type", + "allow_force_pushes_enforcement_level", + "@timestamp", + "org", + "action", + "created_at", + "user_agent", + "repo_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_ignore_approvals_from_contributors", "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "ignore_approvals_from_contributors", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "protected_branch.update_linear_history_requirement_enforcement_level", "description": "Required linear commit history was enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "action", + "user_agent", + "operation_type", + "actor", + "linear_history_requirement_enforcement_level", + "repo", + "name", + "org_id", + "repo_id", + "org", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_lock_allows_fetch_and_merge", "description": "Fork syncing was enabled or disabled for a read-only branch", - "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "lock_allows_fetch_and_merge", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_lock_branch_enforcement_level", "description": "The enforcement of a branch lock was updated.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "enforcement_level", + "lock_branch_enforcement_level", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "merge_queue_enforcement_level", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "protected_branch.update_name", "description": "A branch name pattern was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "old_name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_pull_request_reviews_enforcement_level", "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "name", + "org_id", + "_document_id", + "actor_id", + "@timestamp", + "business_id", + "pull_request_reviews_enforcement_level", + "org", + "repo", + "action", + "business", + "user_agent", + "created_at", + "repo_id", + "operation_type", + "actor", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_require_code_owner_review", "description": "Enforcement of required code owner review was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "created_at", + "require_code_owner_review", + "operation_type", + "name", + "user_agent", + "action", + "@timestamp", + "actor", + "actor_id", + "repo", + "org", + "repo_id", + "_document_id", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_require_last_push_approval", "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "require_last_push_approval", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_required_approving_review_count", "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "required_approving_review_count", + "repo", + "repo_id", + "created_at", + "actor", + "operation_type", + "user_agent", + "name", + "org_id", + "action", + "actor_id", + "_document_id", + "org", + "@timestamp", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_required_status_checks_enforcement_level", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "org_id", + "user_agent", + "@timestamp", + "_document_id", + "name", + "repo", + "action", + "business_id", + "repo_id", + "business", + "actor_id", + "operation_type", + "created_at", + "required_status_checks_enforcement_level", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_signature_requirement_enforcement_level", "description": "Enforcement of required commit signing was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "name", + "@timestamp", + "created_at", + "_document_id", + "repo_id", + "org", + "org_id", + "action", + "actor", + "actor_id", + "signature_requirement_enforcement_level", + "repo", + "user_agent", + "programmatic_access_type" + ] }, { "action": "protected_branch.update_strict_required_status_checks_policy", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "_document_id", + "org", + "@timestamp", + "created_at", + "repo_id", + "org_id", + "user_agent", + "name", + "actor", + "repo", + "operation_type", + "action", + "strict_required_status_checks_policy", + "programmatic_access_type" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "read_only", + "user_agent", + "actor_id", + "operation_type", + "created_at", + "_document_id", + "key", + "fingerprint", + "actor", + "action", + "user", + "user_id", + "@timestamp", + "title", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "fingerprint", + "user_agent", + "read_only", + "explanation", + "repo", + "@timestamp", + "action", + "key", + "operation_type", + "_document_id", + "actor", + "title", + "actor_id", + "repo_id", + "created_at", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "user_agent", + "title", + "key", + "fingerprint", + "read_only", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "created_at", + "operation_type", + "_document_id", + "title", + "key", + "action", + "actor", + "read_only", + "explanation", + "repo_id", + "@timestamp", + "actor_id", + "repo", + "user_agent", + "fingerprint" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "actor", + "user_agent", + "key", + "fingerprint", + "read_only", + "repo_id", + "operation_type", + "created_at", + "actor_id", + "repo", + "action", + "_document_id", + "title", + "@timestamp", + "programmatic_access_type" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "repo_id", + "actor", + "key", + "fingerprint", + "@timestamp", + "actor_id", + "oauth_application_id", + "title", + "action", + "user_agent", + "created_at", + "repo", + "read_only", + "operation_type", + "_document_id", + "user", + "user_id", + "programmatic_access_type" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "operation_type", + "user", + "@timestamp", + "_document_id", + "action", + "created_at", + "key", + "fingerprint", + "actor_id", + "actor", + "title", + "user_agent", + "user_id", + "read_only", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request.close", "description": "A pull request was closed without being merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "pull_request.converted_to_draft", "description": "A pull request was converted to a draft.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request.create", "description": "A pull request was created.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "pull_request.create_review_request", "description": "A review was requested on a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "pull_request.in_progress", "description": "A pull request was marked as in progress.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "pull_request.indirect_merge", "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "pull_request.merge", "description": "A pull request was merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "pull_request.ready_for_review", "description": "A pull request was marked as ready for review.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request.rebase", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "pull_request_url", + "pull_request_title", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "programmatic_access_type" + ] }, { "action": "pull_request.remove_review_request", "description": "A review request was removed from a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "pull_request.reopen", "description": "A pull request was reopened after previously being closed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "pull_request_review_comment.create", "description": "A review comment was added to a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request_review_comment.delete", "description": "A review comment on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "@timestamp", + "_document_id", + "repo", + "created_at", + "actor_id", + "repo_id", + "action", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request_review_comment.update", "description": "A review comment on a pull request was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user_agent", + "actor_id", + "action", + "created_at", + "actor", + "_document_id", + "@timestamp", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request_review.delete", "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "pull_request_review.dismiss", "description": "A review on a pull request was dismissed.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "pull_request_review.submit", "description": "A review on a pull request was submitted.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "pull_request_url", + "programmatic_access_type" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "repo_id", + "user", + "operation_type", + "@timestamp", + "actor_id", + "user_id", + "created_at", + "user_agent", + "actor", + "action", + "repo", + "visibility", + "_document_id", + "previous_visibility", + "programmatic_access_type" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "visibility", + "repo", + "created_at", + "user_agent", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "actor_id", + "repo_id", + "user", + "action", + "user_id", + "oauth_application_id", + "org", + "org_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "action", + "user_agent", + "actor", + "repo", + "repo_id", + "user", + "org", + "org_id", + "actor_id", + "topic", + "@timestamp", + "_document_id", + "user_id", + "created_at", + "operation_type", + "programmatic_access_type" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "repo_id", + "user_agent", + "user_id", + "created_at", + "@timestamp", + "repo", + "user", + "operation_type", + "visibility", + "action", + "actor_id", + "actor", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "oauth_application_id", + "user_agent", + "created_at", + "@timestamp", + "_document_id", + "actor_id", + "operation_type", + "action", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "tool", + "category" + ] + }, + { + "action": "repo.code_scanning_autofix_disabled", + "description": "Autofix for code scanning alerts was disabled for a repository.", + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] + }, + { + "action": "repo.code_scanning_autofix_enabled", + "description": "Autofix for code scanning alerts was enabled for a repository.", + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "actor", + "actor_id", + "user_agent", + "tool", + "branch", + "category", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.codeql_disabled", "description": "Code scanning using the default setup was disabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.codeql_enabled", "description": "Code scanning using the default setup was enabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to this repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "repo.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to this repository was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo_id", + "_document_id", + "action", + "created_at", + "repo", + "operation_type", + "@timestamp" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "repo", + "@timestamp", + "actor", + "_document_id", + "user_agent", + "actor_id", + "repo_id", + "action", + "operation_type", + "created_at" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "actor", + "repo_id", + "action", + "user_agent", + "_document_id", + "@timestamp", + "created_at", + "actor_id", + "repo", + "operation_type" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "actor", + "oauth_application_id", + "created_at", + "action", + "repo_id", + "repo", + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "operation_type" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "user_agent", + "operation_type", + "created_at", + "actor", + "org", + "action", + "actor_id", + "repo", + "repo_id", + "org_id", + "@timestamp", + "_document_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "actor", + "operation_type", + "created_at", + "user_agent", + "action", + "actor_id", + "repo", + "repo_id", + "@timestamp", + "_document_id" + ] }, { "action": "repo.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "repo", + "user_id", + "visibility", + "repo_id", + "user", + "actor_id", + "action", + "operation_type", + "request_category", + "@timestamp", + "created_at", + "_document_id", + "actor", + "user_agent", + "org", + "oauth_application_id", + "org_id", + "request_method", + "business", + "business_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "visibility", + "integration", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "repo", + "_document_id", + "user_agent", + "user_id", + "actor", + "action", + "user", + "repo_id", + "operation_type", + "request_category", + "actor_id", + "visibility", + "created_at", + "@timestamp", + "request_method", + "oauth_application_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.download_zip", "description": "A source code archive of a repository was downloaded as a ZIP file.", - "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives" + "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "@timestamp", + "visibility", + "repo", + "repo_id", + "user", + "actor_id", + "user_agent", + "user_id", + "created_at", + "_document_id", + "action", + "operation_type", + "programmatic_access_type" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user", + "_document_id", + "user_id", + "visibility", + "action", + "user_agent", + "operation_type", + "repo_id", + "created_at", + "@timestamp", + "actor", + "repo", + "programmatic_access_type" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "user_id", + "action", + "user", + "repo", + "user_agent", + "_document_id", + "actor_id", + "@timestamp", + "actor", + "visibility", + "operation_type", + "repo_id", + "programmatic_access_type" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "actor_id", + "repo_id", + "_document_id", + "user_agent", + "actor", + "visibility", + "user_id", + "repo", + "@timestamp", + "operation_type", + "action", + "created_at", + "programmatic_access_type" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "user_agent", + "user_id", + "created_at", + "visibility", + "actor", + "actor_id", + "user", + "operation_type", + "repo_id", + "action", + "repo", + "_document_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "repo.pages_soft_delete", "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.pages_soft_delete_restore", "description": "A GitHub Pages site that was previously soft-deleted was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "actor_id", + "operation_type", + "user_agent", + "actor", + "@timestamp", + "repo_id", + "user", + "_document_id", + "visibility", + "repo", + "created_at", + "action", + "programmatic_access_type" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "actor_id", + "repo", + "operation_type", + "action", + "@timestamp", + "actor", + "user_agent", + "created_at", + "_document_id", + "repo_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "integration", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "user", + "business", + "action", + "actor_id", + "org", + "org_id", + "actor", + "created_at", + "repo_id", + "user_agent", + "business_id", + "user_id", + "operation_type", + "@timestamp", + "_document_id", + "visibility", + "repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "actor_id", + "repo_id", + "@timestamp", + "_document_id", + "repo", + "org_id", + "action", + "operation_type", + "user_agent", + "actor", + "created_at", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "action", + "repo_id", + "user_agent", + "topic", + "operation_type", + "user_id", + "org", + "org_id", + "actor", + "business", + "repo", + "@timestamp", + "created_at", + "_document_id", + "actor_id", + "business_id", + "programmatic_access_type" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "user_agent", + "@timestamp", + "actor_id", + "actor", + "old_name", + "repo", + "user_id", + "created_at", + "user", + "action", + "operation_type", + "visibility", + "repo_id", + "_document_id", + "programmatic_access_type" + ] }, { "action": "repo.rename_branch", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "old_branch", + "new_branch", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "action", + "_document_id", + "actor_id", + "user", + "operation_type", + "user_agent", + "repo_id", + "@timestamp", + "created_at", + "actor", + "user_id" + ] }, { "action": "repo.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "repo_id", + "repo", + "org_id", + "org", + "runner_id", + "runner_name", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp" + ] }, { "action": "repo.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "repo_id", + "repo", + "org_id", + "org", + "runner_id", + "runner_name", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp" + ] }, { "action": "repo.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "repo_id", + "runner_id", + "runner_name", + "source_version", + "target_version", + "runner_group_id", + "runner_group_name" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "policy", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "policy", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "limit", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "repo", + "repo_id", + "public_repo", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "policy", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "repo", + "repo_id", + "public_repo", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "created_at", + "actor", + "repo_id", + "action", + "org", + "org_id", + "repo", + "operation_type" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "user_id", + "_document_id", + "actor_id", + "repo_id", + "owner", + "user", + "old_user", + "action", + "operation_type", + "created_at", + "user_agent", + "repo", + "visibility", + "repo_was", + "actor" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "visibility", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "operation_type", + "user_id", + "user", + "action", + "user_agent", + "created_at", + "actor", + "visibility", + "repo_id", + "actor_id", + "repo" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "actor", + "actor_id", + "repo", + "operation_type", + "created_at", + "_document_id", + "repo_id", + "user", + "@timestamp", + "visibility", + "user_agent", + "user_id", + "action", + "programmatic_access_type" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "policy", + "old_policy", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "new_policy", + "old_policy", + "updated_access_policy", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "visibility", + "integration", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "action", + "_document_id", + "actor", + "repo_id", + "created_at", + "oauth_application_id", + "user", + "@timestamp", + "repo", + "operation_type", + "org_id", + "actor_id", + "visibility", + "old_permission", + "org", + "user_id", + "old_base_role", + "old_repo_permission", + "old_repo_base_role", + "new_repo_base_role", + "new_repo_permission", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repository_advisory.close", "description": "Someone closed a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", + "fields": [ + "actor", + "repo", + "@timestamp", + "business", + "business_id", + "user_agent", + "actor_id", + "action", + "operation_type", + "created_at", + "repo_id", + "_document_id", + "org", + "org_id" + ] }, { "action": "repository_advisory.cve_request", "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "repo", + "org_id", + "actor", + "action", + "org", + "operation_type", + "@timestamp", + "user_agent", + "actor_id", + "_document_id", + "created_at" + ] }, { "action": "repository_advisory.github_broadcast", "description": "GitHub made a security advisory public in the GitHub Advisory Database.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "repository_advisory.github_withdraw", "description": "GitHub withdrew a security advisory that was published in error.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repository_advisory.open", "description": "Someone opened a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user_agent", + "actor_id", + "actor", + "repo", + "created_at", + "_document_id", + "repo_id", + "action", + "@timestamp" + ] }, { "action": "repository_advisory.publish", "description": "Someone published a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user_agent", + "actor_id", + "@timestamp", + "actor", + "repo_id", + "_document_id", + "repo", + "business_id", + "business", + "action", + "created_at", + "org_id", + "org" + ] }, { "action": "repository_advisory.reopen", "description": "Someone reopened as draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user_agent", + "repo", + "action", + "created_at", + "@timestamp", + "actor_id", + "_document_id", + "actor", + "repo_id", + "public_repo" + ] }, { "action": "repository_advisory.update", "description": "Someone edited a draft or published security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "repo_id", + "org_id", + "business", + "actor", + "user_agent", + "created_at", + "_document_id", + "business_id", + "repo", + "action", + "operation_type", + "org", + "@timestamp" + ] }, { "action": "repository_branch_protection_evaluation.disable", "description": "Branch protections were disabled for the repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "org", + "org_id", + "business_id", + "user", + "user_id", + "business", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repository_branch_protection_evaluation.enable", "description": "Branch protections were enabled for this repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "org", + "org_id", + "business_id", + "user", + "user_id", + "business", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repository_content_analysis.disable", "description": "Data use settings were disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "user", + "repo_id", + "actor_id", + "created_at", + "user_agent", + "action", + "operation_type", + "actor", + "repo", + "user_id", + "@timestamp", + "_document_id" + ] }, { "action": "repository_content_analysis.enable", "description": "Data use settings were enabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "user", + "org", + "user_id", + "repo_id", + "@timestamp", + "actor", + "action", + "operation_type", + "created_at", + "actor_id", + "repo", + "user_agent", + "org_id", + "_document_id" + ] }, { "action": "repository_dependency_graph.disable", "description": "The dependency graph was disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "repo_id", + "operation_type", + "user_id", + "repo", + "_document_id", + "actor", + "user", + "action", + "@timestamp", + "org_id", + "actor_id", + "org", + "created_at", + "user_agent", + "programmatic_access_type" + ] }, { "action": "repository_dependency_graph.enable", "description": "The dependency graph was enabled for a private repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "org", + "org_id", + "action", + "repo", + "user_id", + "created_at", + "user_agent", + "actor_id", + "repo_id", + "operation_type", + "actor", + "@timestamp", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "operation_type", + "created_at", + "actor_id", + "repo_id", + "action", + "actor", + "content_type", + "repo", + "@timestamp", + "_document_id", + "user", + "user_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "content_type", + "created_at", + "actor_id", + "user_id", + "operation_type", + "_document_id", + "actor", + "repo_id", + "user_agent", + "repo", + "user", + "action", + "@timestamp" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "created_at", + "repo", + "invitee", + "operation_type", + "actor", + "repo_id", + "_document_id", + "action", + "user_agent", + "inviter", + "@timestamp", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "inviter", + "action", + "operation_type", + "_document_id", + "repo_id", + "repo", + "@timestamp", + "user_agent", + "invitee", + "created_at", + "actor", + "actor_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "actor", + "actor_id", + "@timestamp", + "invitee", + "action", + "inviter", + "repo", + "created_at", + "user_agent", + "repo_id", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "_document_id", + "actor", + "invitee", + "action", + "@timestamp", + "actor_id", + "operation_type", + "created_at", + "inviter", + "user_agent", + "repo_id" + ] }, { "action": "repository_projects_change.clear", "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", + "fields": [ + "created_at", + "_document_id", + "action", + "user_agent", + "user", + "business_id", + "business", + "operation_type", + "actor", + "actor_id", + "user_id", + "@timestamp" + ] }, { "action": "repository_projects_change.disable", "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "@timestamp", + "repo", + "action", + "operation_type", + "_document_id", + "actor_id", + "user", + "user_id", + "user_agent", + "repo_id", + "actor", + "programmatic_access_type" + ] }, { "action": "repository_projects_change.enable", "description": "Repository projects were enabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "actor", + "repo_id", + "org", + "user", + "user_agent", + "created_at", + "org_id", + "action", + "user_id", + "operation_type", + "_document_id", + "actor_id", + "repo" + ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "ruleset_id", + "ruleset_name", + "ruleset_enforcement", + "ruleset_source_type", + "ruleset_rules", + "ruleset_conditions", + "ruleset_bypass_actors" + ] }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", + "fields": [ + "actor", + "actor_id", + "user_agent", + "old_name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "ruleset_id", + "ruleset_name", + "ruleset_enforcement", + "ruleset_source_type", + "ruleset_rules_updated", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_old_enforcement", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_old_name", + "ruleset_conditions_updated", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo" + ] }, { "action": "repository_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo" + ] }, { "action": "repository_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo" + ] }, { "action": "repository_secret_scanning.disable", "description": "Secret scanning was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "repository_secret_scanning.enable", "description": "Secret scanning was enabled for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "repository_secret_scanning_generic_secrets.disabled", "description": "Generic secrets have been disabled at the repository level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_generic_secrets.enabled", "description": "Generic secrets have been enabled at the repository level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_secret_scanning_push_protection.disable", "description": "Secret scanning push protection was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "repository_secret_scanning_push_protection.enable", "description": "Secret scanning push protection was enabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "repository_visibility_change.clear", "description": "The repository visibility change setting was cleared for an organization or enterprise.", - "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility" + "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", + "fields": [ + "created_at", + "_document_id", + "actor_id", + "business", + "action", + "operation_type", + "user", + "user_id", + "business_id", + "@timestamp", + "user_agent", + "actor" + ] }, { "action": "repository_visibility_change.disable", "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "org_id", + "created_at", + "user_agent", + "actor", + "actor_id", + "org", + "operation_type", + "_document_id", + "@timestamp", + "user_id", + "action" + ] }, { "action": "repository_visibility_change.enable", "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "operation_type", + "_document_id", + "@timestamp", + "user_agent", + "user", + "created_at", + "org", + "org_id", + "action", + "actor_id", + "user_id" + ] }, { "action": "repository_vulnerability_alert.auto_dismiss", "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", + "fields": [ + "actor", + "actor_id", + "user_agent", + "alert_number", + "ghsa_id", + "action", + "repo", + "repo_id", + "public_repo", + "owner", + "org", + "org_id", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repository_vulnerability_alert.auto_reopen", "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", + "fields": [ + "actor", + "actor_id", + "user_agent", + "alert_number", + "ghsa_id", + "action", + "repo", + "repo_id", + "public_repo", + "owner", + "org", + "org_id", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repository_vulnerability_alert.create", "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", + "fields": [ + "operation_type", + "repo_id", + "@timestamp", + "user_agent", + "action", + "repo", + "created_at", + "_document_id", + "token_scopes", + "alert_number", + "programmatic_access_type" + ] }, { "action": "repository_vulnerability_alert.dismiss", "description": "A Dependabot alert was manually dismissed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "org_id", + "user_id", + "@timestamp", + "operation_type", + "user_agent", + "actor", + "repo", + "created_at", + "org", + "_document_id", + "action", + "actor_id", + "dismiss_reason", + "user", + "dismiss_comment", + "alert_number", + "actor_is_bot" + ] }, { "action": "repository_vulnerability_alert.reintroduce", "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "action", + "repo", + "repo_id", + "public_repo", + "owner", + "_document_id", + "@timestamp", + "operation_type", + "token_scopes", + "alert_number" + ] }, { "action": "repository_vulnerability_alert.reopen", "description": "A Dependabot alert was manually reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "action", + "repo", + "repo_id", + "owner", + "org", + "org_id", + "_document_id", + "@timestamp", + "operation_type", + "business", + "business_id", + "public_repo", + "alert_number" + ] }, { "action": "repository_vulnerability_alert.resolve", "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "operation_type", + "action", + "repo_id", + "_document_id", + "user_agent", + "@timestamp", + "created_at", + "actor", + "actor_id", + "token_scopes", + "alert_number", + "programmatic_access_type" + ] }, { "action": "repository_vulnerability_alerts.authorized_users_teams", "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", + "fields": [ + "org", + "_document_id", + "repo", + "org_id", + "operation_type", + "created_at", + "actor", + "action", + "@timestamp", + "user_agent", + "repo_id", + "actor_id" + ] }, { "action": "repository_vulnerability_alerts_auto_dismissal.disable", "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repository_vulnerability_alerts_auto_dismissal.enable", "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "repository_vulnerability_alerts.disable", "description": "Dependabot alerts was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "repo_id", + "action", + "actor_id", + "@timestamp", + "created_at", + "actor", + "user_agent", + "org_id", + "user", + "org", + "_document_id", + "user_id", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repository_vulnerability_alerts.enable", "description": "Dependabot alerts was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "user_agent", + "created_at", + "@timestamp", + "repo_id", + "action", + "user", + "repo", + "org", + "org_id", + "actor_id", + "_document_id", + "user_id", + "operation_type", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "required_status_check.create", "description": "A status check was marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "org", + "actor_id", + "@timestamp", + "business", + "context", + "repo_id", + "action", + "repo", + "_document_id", + "operation_type", + "business_id", + "org_id", + "actor", + "created_at", + "user_agent", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "required_status_check.destroy", "description": "A status check was no longer marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "actor_id", + "actor", + "created_at", + "context", + "operation_type", + "@timestamp", + "org", + "user_agent", + "repo_id", + "org_id", + "action", + "_document_id", + "repo", + "programmatic_access_type" + ] }, { "action": "restrict_notification_delivery.disable", "description": "Email notification restrictions for an organization or enterprise were disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "business", + "business_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "restrict_notification_delivery.enable", "description": "Email notification restrictions for an organization or enterprise were enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "role.create", "description": "A new custom repository role was created.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "name", + "owner", + "base_role", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "role_permissions", + "old_role_permissions" + ] }, { "action": "role.destroy", "description": "A custom repository role was deleted.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "name", + "owner", + "role_permissions", + "base_role", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "role.update", "description": "A custom repository role was edited.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "owner", + "role_permissions", + "base_role", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "old_role_permissions", + "old_base_role" + ] }, { "action": "secret_scanning_alert.create", "description": "GitHub detected a secret and created a secret scanning alert.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "repo_id", + "repo", + "actor_id", + "actor", + "org_id", + "org", + "business", + "business_id", + "number" + ] }, { "action": "secret_scanning_alert.reopen", "description": "A seret scanning alert was reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "number", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes" + ] }, { "action": "secret_scanning_alert.resolve", "description": "A seret scanning alert was resolved.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "number", + "resolution", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes" + ] }, { "action": "secret_scanning_alert.revoke", "description": "A secret scanning alert was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "number", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "secret_scanning_alert.validate", "description": "A secret scanning alert was validated.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "repo_id", + "repo", + "actor_id", + "actor", + "org_id", + "org", + "business", + "business_id", + "number", + "created_at", + "previous_validity", + "current_validity" + ] }, { "action": "secret_scanning.disable", "description": "Secret scanning was disabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "secret_scanning.enable", "description": "Secret scanning was enabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "secret_scanning_new_repos.disable", "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "secret_scanning_new_repos.enable", "description": "Secret scanning was enabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "secret_scanning_push_protection.bypass", "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", + "fields": [ + "repo_id", + "repo", + "actor_id", + "actor", + "org_id", + "org", + "business", + "business_id", + "number", + "created_at", + "push_protection_bypass_reason" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.invoiced_agreement_sign", "description": "An agreement for invoiced billing for GitHub Sponsors was signed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org_id", + "org", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "action", + "created_at", + "_document_id", + "actor", + "user_agent", + "actor_id", + "operation_type" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "operation_type", + "_document_id", + "created_at", + "actor", + "user", + "action", + "actor_id", + "user_id", + "@timestamp" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "actor", + "user_id", + "action", + "@timestamp", + "user_agent", + "user", + "operation_type", + "created_at", + "actor_id", + "_document_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "active", + "user", + "user_id", + "actor", + "actor_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "actor_id", + "action", + "@timestamp", + "user_id", + "created_at", + "user", + "_document_id", + "user_agent", + "actor", + "operation_type" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "user_id", + "actor", + "actor_id", + "action", + "user", + "operation_type", + "@timestamp", + "_document_id", + "created_at" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "user_id", + "action", + "user_agent", + "actor", + "user", + "operation_type", + "@timestamp", + "created_at", + "actor_id", + "_document_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "user_id", + "operation_type", + "actor_id", + "@timestamp", + "_document_id", + "user", + "action", + "created_at", + "user_agent", + "actor" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "actor_id", + "operation_type", + "created_at", + "user_agent", + "actor", + "action", + "_document_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "created_at", + "user", + "action", + "user_agent", + "operation_type", + "_document_id", + "actor", + "actor_id", + "user_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "user_agent", + "user", + "@timestamp", + "actor_id", + "user_id", + "_document_id", + "actor", + "action", + "operation_type", + "created_at" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "operation_type", + "actor", + "user_id", + "action", + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "user", + "created_at" + ] }, { "action": "sponsors.sponsors_patreon_user_create", "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", + "fields": [ + "actor", + "actor_id", + "user_agent", + "patreon_email", + "patreon_username", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.sponsors_patreon_user_destroy", "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", + "fields": [ + "actor", + "actor_id", + "user_agent", + "patreon_email", + "patreon_username", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "ssh_certificate_authority.create", "description": "An SSH certificate authority for an organization or enterprise was created.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "fingerprint", + "operation_type", + "openssh_public_key", + "org_id", + "actor", + "created_at", + "org", + "action", + "user_agent", + "actor_id" + ] }, { "action": "ssh_certificate_authority.destroy", "description": "An SSH certificate authority for an organization or enterprise was deleted.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "created_at", + "_document_id", + "fingerprint", + "operation_type", + "actor", + "org_id", + "openssh_public_key", + "org", + "action", + "user_agent", + "actor_id", + "@timestamp" + ] }, { "action": "ssh_certificate_requirement.disable", "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "user", + "user_agent", + "operation_type", + "_document_id", + "org", + "org_id", + "created_at", + "actor", + "action", + "user_id", + "business", + "business_id", + "@timestamp", + "actor_id" + ] }, { "action": "ssh_certificate_requirement.enable", "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "actor_id", + "user_id", + "org", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "user", + "action", + "org_id", + "created_at", + "user_agent" + ] }, { "action": "staff.dependabot_debug_credentials_generated", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "staff.set_domain_token_expiration", "description": "The verification code expiry time for an organization or enterprise domain was set.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner_type", + "business_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "staff.unverify_domain", "description": "An organization or enterprise domain was unverified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "owner_type", + "owner", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "staff.verify_domain", "description": "An organization or enterprise domain was verified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "team.add_member", "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", + "fields": [ + "user_agent", + "org_id", + "user_id", + "team", + "user", + "@timestamp", + "actor_id", + "created_at", + "operation_type", + "_document_id", + "org", + "action", + "actor", + "programmatic_access_type" + ] }, { "action": "team.add_repository", "description": "A team was given access and permissions to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "team", + "action", + "operation_type", + "created_at", + "@timestamp", + "org", + "repo", + "actor_id", + "_document_id", + "repo_id", + "user_agent", + "org_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "team.change_parent_team", "description": "A child team was created or a child team's parent was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" + "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", + "fields": [ + "org", + "@timestamp", + "created_at", + "_document_id", + "team", + "action", + "operation_type", + "actor", + "actor_id", + "user_agent", + "org_id", + "programmatic_access_type" + ] }, { "action": "team.change_privacy", "description": "A team's privacy level was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility" + "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", + "fields": [ + "user_agent", + "org", + "action", + "team", + "created_at", + "operation_type", + "actor_id", + "org_id", + "@timestamp", + "actor", + "_document_id" + ] }, { "action": "team.create", "description": "A new team is created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "oauth_application_id", + "action", + "operation_type", + "@timestamp", + "org_id", + "user_agent", + "team", + "org", + "actor", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "team.demote_maintainer", "description": "A user was demoted from a team maintainer to a team member.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", + "fields": [ + "user_agent", + "actor", + "actor_id", + "team", + "org", + "org_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "team.destroy", "description": "A team was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "org", + "team", + "org_id", + "actor_id", + "actor", + "action", + "@timestamp", + "user_agent", + "operation_type", + "_document_id", + "programmatic_access_type" + ] }, { "action": "team_discussions.clear", "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "business_id", + "operation_type", + "@timestamp", + "user_agent", + "actor", + "actor_id", + "user", + "business", + "action", + "created_at", + "user_id", + "_document_id" + ] }, { "action": "team_discussions.disable", "description": "Team discussions were disabled for an organization.", - "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization" + "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization", + "fields": [ + "org_id", + "action", + "operation_type", + "actor", + "org", + "created_at", + "actor_id", + "user", + "user_id", + "@timestamp", + "user_agent", + "_document_id" + ] }, { "action": "team_discussions.enable", "description": "Team discussions were enabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "@timestamp", + "action", + "_document_id", + "user_agent", + "user_id", + "business_id", + "user", + "business", + "operation_type", + "actor", + "created_at" + ] }, { "action": "team_group_mapping.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "actor", + "action", + "operation_type", + "team", + "@timestamp", + "actor_id", + "org", + "_document_id", + "org_id", + "user_agent" + ] }, { "action": "team_group_mapping.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "@timestamp", + "actor_id", + "_document_id", + "team", + "created_at", + "org_id", + "action", + "user_agent", + "actor", + "org" + ] }, { "action": "team_group_mapping.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "team", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "programmatic_access_type" + ] }, { "action": "team.promote_maintainer", "description": "A user was promoted from a team member to a team maintainer.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", + "fields": [ + "user_agent", + "actor", + "actor_id", + "team", + "org", + "org_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "team.remove_member", "description": "An organization member was removed from a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", + "fields": [ + "operation_type", + "created_at", + "actor_id", + "org", + "org_id", + "team", + "user_id", + "actor", + "user", + "action", + "@timestamp", + "user_agent", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org_id", + "repo", + "repo_id", + "action", + "_document_id", + "actor", + "@timestamp", + "actor_id", + "user_agent", + "created_at", + "team", + "org", + "operation_type", + "programmatic_access_type" + ] }, { "action": "team.rename", "description": "A team's name was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "name", + "user_agent", + "created_at", + "team", + "operation_type", + "actor_id", + "org", + "action", + "actor", + "org_id", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "team_sync_tenant.disabled", "description": "Team synchronization with a tenant was disabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "action", + "created_at", + "actor", + "org_id", + "actor_id", + "operation_type", + "_document_id", + "@timestamp", + "org", + "user_agent" + ] }, { "action": "team_sync_tenant.enabled", "description": "Team synchronization with a tenant was enabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "org_id", + "business_id", + "actor", + "created_at", + "user_agent", + "@timestamp", + "operation_type", + "business", + "actor_id", + "org", + "action", + "_document_id" + ] }, { "action": "team_sync_tenant.update_okta_credentials", "description": "The Okta credentials for team synchronization with a tenant were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "team", + "org_id", + "@timestamp", + "org", + "_document_id", + "old_permission", + "repo", + "action", + "repo_id", + "actor", + "operation_type", + "created_at", + "user_agent", + "permission", + "new_repo_permission", + "new_repo_base_role", + "old_repo_permission", + "old_repo_base_role", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "vulnerability_alert_rule.create", "description": "A Dependabot rule was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "vulnerability_alert_rule.delete", "description": "A Dependabot rule was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "vulnerability_alert_rule.disable", "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "vulnerability_alert_rule.enable", "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "vulnerability_alert_rule.force_disable", "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "action", + "org", + "org_id", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "vulnerability_alert_rule.force_enable", "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "action", + "org", + "org_id", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "vulnerability_alert_rule.update", "description": "A Dependabot rule's conditions, actions, or metadata changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "user_agent", + "actor", + "actor_id", + "workflow_run_id", + "run_number", + "user", + "user_id", + "repo", + "repo_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "workflow_run_id", + "run_number", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "workflows.cancel_workflow_run", "description": "A workflow run was cancelled.", - "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow" + "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "started_at", + "event", + "name", + "workflow_run_id", + "head_branch", + "head_sha", + "run_number", + "cancelled_at", + "workflow_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "business", + "business_id", + "trigger_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "token_id", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "workflow_run_id", + "run_number", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "workflows.completed_workflow_run", "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history" + "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "started_at", + "event", + "name", + "workflow_run_id", + "head_branch", + "head_sha", + "completed_at", + "conclusion", + "run_number", + "workflow_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "business", + "business_id", + "trigger_id", + "run_attempt", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "workflows.created_workflow_run", "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow" + "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "started_at", + "event", + "name", + "workflow_run_id", + "head_branch", + "head_sha", + "workflow_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "business", + "business_id", + "trigger_id", + "public_repo", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "workflow_run_id", + "started_at", + "head_branch", + "head_sha", + "trigger_id", + "programmatic_access_type" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "workflow_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "workflow_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "workflows.prepared_workflow_job", "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows" + "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", + "fields": [ + "repo_id", + "repo", + "org_id", + "org", + "business_id", + "business", + "workflow_run_id", + "job_name", + "runner_labels", + "is_hosted_runner", + "environment_name", + "secrets_passed", + "action", + "_document_id", + "operation_type", + "created_at", + "@timestamp", + "runner_owner_type", + "job_workflow_ref", + "calling_workflow_refs", + "calling_workflow_shas", + "imposer_repo" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "user_agent", + "actor", + "actor_id", + "workflow_run_id", + "run_number", + "user", + "user_id", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "workflows.rerun_workflow_run", "description": "A workflow run was re-run.", - "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs" + "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "started_at", + "event", + "name", + "workflow_run_id", + "head_branch", + "head_sha", + "run_number", + "workflow_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "business", + "business_id", + "trigger_id", + "run_attempt", + "rerun_type", + "check_run_id", + "programmatic_access_type", + "actor_is_bot" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghec/user.json b/src/audit-logs/data/ghec/user.json index d39c9dadd90a..1c26212c7059 100644 --- a/src/audit-logs/data/ghec/user.json +++ b/src/audit-logs/data/ghec/user.json @@ -2,1851 +2,7234 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "@timestamp", + "operation_type", + "user_agent", + "_document_id", + "created_at", + "action", + "actor", + "actor_id", + "org_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "actor", + "operation_type", + "_document_id", + "user_agent", + "created_at", + "actor_id", + "@timestamp", + "user", + "action", + "user_id", + "programmatic_access_type" + ] }, { "action": "account_recovery_token.confirm", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "action", + "@timestamp", + "user_agent", + "created_at", + "_document_id", + "token_id", + "user_id", + "user", + "actor", + "operation_type" + ] }, { "action": "account_recovery_token.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "created_at", + "token_id", + "user", + "_document_id", + "user_agent", + "actor", + "user_id", + "actor_id", + "operation_type", + "@timestamp" + ] }, { "action": "account_recovery_token.recover", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "@timestamp", + "actor_id", + "operation_type", + "created_at", + "actor", + "user_agent", + "action", + "_document_id", + "user_id", + "token_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "user_id", + "user", + "repo_id", + "repo", + "org", + "org_id", + "actions_cache_id", + "actions_cache_key", + "actions_cache_version", + "actions_cache_scope", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "actor", + "user_agent", + "actor_id", + "repo", + "repo_id", + "@timestamp", + "created_at", + "_document_id", + "operation_type", + "programmatic_access_type" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "actor_id", + "user", + "@timestamp", + "actor", + "user_id", + "action", + "created_at", + "operation_type", + "_document_id", + "user_agent" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "actor", + "operation_type", + "actor_id", + "org_id", + "@timestamp", + "user_agent", + "created_at", + "_document_id", + "org", + "email", + "action" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "oauth_application_id", + "@timestamp", + "actor_id", + "operation_type", + "_document_id", + "actor", + "user", + "user_id", + "user_agent", + "created_at", + "action" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user", + "operation_type", + "user_agent", + "created_at", + "user_id", + "actor", + "action", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "billing.update_bill_cycle_day", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.set_actions_fork_pr_approvals_policy", "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "policy", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "policy", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "limit", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "business.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "policy", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "business.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "visibility", + "user_agent", + "user", + "@timestamp", + "repo", + "actor_id", + "user_id", + "action", + "created_at", + "actor", + "operation_type", + "repo_id", + "_document_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "actor", + "actor_id", + "operation_type", + "repo_id", + "action", + "created_at", + "_document_id", + "user_agent", + "repo", + "programmatic_access_type" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "origin_repository", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "user_id", + "org_id", + "owner", + "name", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot", + "machine_type", + "devcontainer_path" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "owner", + "name", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot", + "machine_type", + "devcontainer_path" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "user_agent", + "actor", + "actor_id", + "pull_request_id", + "owner", + "name", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "owner", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.start_environment", "description": "A codespace was started.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "org", + "owner", + "pull_request_id", + "machine_type", + "user_id", + "user", + "devcontainer_path", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "user_agent", + "actor", + "actor_id", + "business", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "copilot.cfb_seat_added", "description": "A seat was added to the Copilot Business subscription for a user and they have received access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "token_id", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_assignment_created", "description": "A seat assignment was newly created for a user.", - "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business" + "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", + "fields": [ + "actor", + "actor_id", + "user_agent", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.cfb_seat_assignment_refreshed", "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "token_id", + "token_scopes", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_assignment_reused", "description": "A seat assignment was re-created for a user who already had a seat with no pending cancellation date.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "copilot.cfb_seat_assignment_unassigned", "description": "A seat was unassigned from a user and they will lose access to GitHub Copilot at the end of the billing cycle.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "copilot.cfb_seat_cancelled", "description": "A seat was canceled from the Copilot Business subscription and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "seat_assignment" + ] }, { "action": "copilot.cfb_seat_cancelled_by_staff", "description": "A seat was canceled from the Copilot Business subscription manually by GitHub and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user_id", + "user", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "environment_name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "environment_name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "actor_is_bot" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "public_repo", + "token_scopes" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "environment_name", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "environment_name", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "git_signing_ssh_public_key.create", "description": "An SSH key was added to a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "actor", + "actor_id", + "user_agent", + "title", + "key", + "fingerprint", + "user_id", + "user", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes" + ] }, { "action": "git_signing_ssh_public_key.delete", "description": "An SSH key was removed from a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "actor", + "actor_id", + "user_agent", + "title", + "key", + "fingerprint", + "user_id", + "explanation", + "user", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "runner_group_id", + "business", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "business", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "actor_is_bot" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "runner_group_id", + "business", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "gpg_key.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "created_at", + "user_id", + "@timestamp", + "user", + "operation_type", + "_document_id", + "actor", + "action", + "user_agent" + ] }, { "action": "gpg_key.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "operation_type", + "actor", + "actor_id", + "user", + "action", + "created_at", + "_document_id", + "user_agent", + "@timestamp" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "name", + "events", + "active", + "active_was", + "hook_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "programmatic_access_type" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "name", + "org", + "user_agent", + "hook_id", + "repo", + "repo_id", + "created_at", + "oauth_application_id", + "action", + "events", + "org_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "oauth_application", + "_document_id", + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "repo_id", + "hook_id", + "events", + "repo", + "@timestamp", + "operation_type", + "name", + "action", + "created_at", + "org_id", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "events", + "repo", + "created_at", + "org", + "name", + "actor_id", + "repo_id", + "org_id", + "action", + "operation_type", + "oauth_application_id", + "user_agent", + "hook_id", + "@timestamp", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "events", + "repo", + "operation_type", + "action", + "_document_id", + "actor_id", + "name", + "events_were", + "@timestamp", + "created_at", + "hook_id", + "repo_id", + "org_id", + "org", + "user_agent", + "oauth_application_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "action", + "operation_type", + "@timestamp", + "actor", + "user_agent", + "actor_id", + "name", + "user_id", + "_document_id", + "integration", + "created_at", + "programmatic_access_type" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "user_id", + "actor_id", + "@timestamp", + "name", + "integration", + "user", + "_document_id", + "action", + "operation_type", + "created_at", + "user_agent" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "operation_type", + "@timestamp", + "name", + "repository_selection", + "user_id", + "action", + "user_agent", + "user", + "created_at", + "integration", + "_document_id", + "programmatic_access_type" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "actor", + "created_at", + "_document_id", + "repository_selection", + "integration", + "user_id", + "user", + "action", + "operation_type", + "name", + "actor_id", + "user_agent", + "programmatic_access_type" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "user_id", + "repository_selection", + "name", + "user", + "integration", + "operation_type", + "actor_id", + "action", + "repositories_added", + "created_at", + "_document_id", + "@timestamp", + "actor", + "user_agent", + "token_scopes", + "repositories_added_names", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "user", + "operation_type", + "user_agent", + "actor", + "repository_selection", + "repositories_removed", + "integration", + "user_id", + "created_at", + "_document_id", + "@timestamp", + "name", + "action", + "actor_id", + "repositories_removed_names", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "user_agent", + "name", + "repository_selection", + "actor_id", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "user_agent", + "name", + "repository_selection", + "actor_id", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "integration", + "user_id", + "user_agent", + "name", + "user", + "operation_type", + "actor_id", + "action", + "_document_id", + "created_at", + "repository_selection", + "@timestamp", + "actor" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "created_at", + "action", + "_document_id", + "name", + "org_id", + "manager", + "operation_type", + "actor", + "integration", + "org", + "@timestamp", + "actor_id", + "user_agent" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "user_agent", + "actor_id", + "org", + "operation_type", + "integration", + "org_id", + "_document_id", + "action", + "actor", + "name", + "created_at", + "manager", + "@timestamp" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "integration", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "integration.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation" + "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "integration", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "user_id", + "name", + "user", + "action", + "actor_id", + "created_at", + "_document_id", + "user_agent", + "operation_type", + "actor", + "integration" + ] }, { "action": "integration.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation" + "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "integration", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "@timestamp", + "_document_id", + "user_agent", + "operation_type", + "created_at", + "action", + "user", + "user_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "secondary_category", + "actor", + "primary_category", + "user", + "@timestamp", + "_document_id", + "user_id", + "user_agent", + "operation_type", + "created_at", + "actor_id", + "marketplace_listing", + "integration", + "action" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "primary_category", + "user_agent", + "actor", + "marketplace_listing", + "@timestamp", + "integration", + "org_id", + "action", + "org", + "secondary_category", + "operation_type", + "created_at", + "actor_id", + "_document_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "primary_category", + "_document_id", + "user", + "created_at", + "user_agent", + "oauth_application", + "action", + "marketplace_listing", + "user_id", + "secondary_category", + "oauth_application_id", + "actor", + "actor_id", + "operation_type", + "@timestamp" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "actor", + "actor_id", + "user_agent", + "org_id", + "created_at", + "secondary_category", + "operation_type", + "marketplace_listing", + "action", + "@timestamp", + "_document_id", + "primary_category", + "integration" + ] }, { "action": "marketplace_listing_plan.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "created_at", + "actor", + "action", + "operation_type", + "marketplace_listing", + "has_free_trial", + "user_agent", + "actor_id", + "yearly_price_in_cents", + "description", + "bullets", + "monthly_price_in_cents", + "marketplace_listing_plan", + "_document_id" + ] }, { "action": "marketplace_listing_plan.publish", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "marketplace_listing_plan", + "marketplace_listing", + "description", + "bullets", + "has_free_trial", + "created_at", + "actor_id", + "operation_type", + "_document_id", + "action", + "user_agent", + "actor", + "monthly_price_in_cents", + "yearly_price_in_cents", + "@timestamp" + ] }, { "action": "marketplace_listing_plan.retire", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "marketplace_listing_plan", + "_document_id", + "description", + "yearly_price_in_cents", + "@timestamp", + "created_at", + "actor_id", + "bullets", + "has_free_trial", + "marketplace_listing", + "user_agent", + "monthly_price_in_cents", + "action", + "operation_type" + ] }, { "action": "marketplace_listing_plan.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "monthly_price_in_cents", + "marketplace_listing", + "_document_id", + "action", + "description", + "bullets", + "yearly_price_in_cents", + "actor_id", + "has_free_trial", + "marketplace_listing_plan", + "user_agent", + "@timestamp", + "operation_type", + "actor", + "created_at" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "secondary_category", + "oauth_application_id", + "@timestamp", + "action", + "user_agent", + "user_id", + "operation_type", + "oauth_application", + "actor", + "created_at", + "marketplace_listing", + "actor_id", + "primary_category", + "user" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "primary_category", + "secondary_category", + "marketplace_listing", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "max_entries_to_build", + "min_entries_to_merge", + "repo_id", + "public_repo", + "repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "@timestamp", + "_document_id", + "user_id", + "action", + "operation_type", + "created_at" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "action", + "org", + "created_at", + "operation_type", + "org_id", + "@timestamp", + "_document_id", + "user_agent", + "actor" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "org_id", + "_document_id", + "org", + "repo_id", + "action", + "actor", + "created_at", + "operation_type", + "@timestamp", + "user_agent", + "actor_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "oauth_access.create", "description": "An OAuth access token was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", + "fields": [ + "_document_id", + "operation_type", + "user_agent", + "actor", + "@timestamp", + "user", + "user_id", + "created_at", + "action", + "actor_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "oauth_access.destroy", "description": "An OAuth access token was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "user_agent", + "action", + "operation_type", + "_document_id", + "actor", + "created_at", + "user", + "user_id", + "explanation", + "hashed_token", + "actor_id", + "token_scopes" + ] }, { "action": "oauth_access.regenerate", "description": "An OAuth access token was regenerated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "user_id", + "_document_id", + "created_at", + "@timestamp", + "operation_type", + "action", + "user_agent", + "actor", + "actor_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "oauth_access.update", "description": "An OAuth access token was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "actor", + "operation_type", + "_document_id", + "user_id", + "created_at", + "action", + "@timestamp", + "user", + "user_agent" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "org", + "created_at", + "oauth_application_id", + "operation_type", + "user_agent", + "actor_id", + "org_id", + "action", + "actor", + "oauth_application", + "@timestamp", + "_document_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "created_at", + "oauth_application_id", + "user_id", + "operation_type", + "@timestamp", + "user_agent", + "oauth_application", + "_document_id", + "actor", + "actor_id", + "action", + "user" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user", + "user_id", + "action", + "oauth_application", + "operation_type", + "actor_id", + "_document_id", + "created_at", + "actor", + "oauth_application_id", + "@timestamp", + "user_agent" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application", + "oauth_application_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "oauth_application_id", + "oauth_application", + "actor_id", + "user_agent", + "@timestamp", + "user_id", + "action", + "_document_id", + "actor", + "user", + "created_at", + "operation_type" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "actor", + "operation_type", + "created_at", + "user_agent", + "oauth_application", + "actor_id", + "oauth_application_id", + "@timestamp", + "user_id", + "_document_id", + "user", + "action" + ] }, { "action": "oauth_authorization.create", "description": "An authorization for an OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "operation_type", + "user_agent", + "user_id", + "actor", + "org_id", + "_document_id", + "action", + "@timestamp", + "created_at", + "actor_id", + "user", + "business", + "business_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "oauth_authorization.destroy", "description": "An authorization for an OAuth application was deleted.", - "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations" + "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", + "fields": [ + "user_agent", + "_document_id", + "operation_type", + "@timestamp", + "actor", + "created_at", + "explanation", + "user", + "user_id", + "org_id", + "action", + "actor_id", + "token_scopes", + "actor_is_bot" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "permission", + "_document_id", + "org", + "operation_type", + "actor", + "user", + "@timestamp", + "created_at", + "user_agent", + "org_id", + "user_id", + "actor_id", + "action", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "inviter", + "org", + "org_id", + "repo", + "repo_id", + "public_repo", + "permission", + "invitee", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "actor_id", + "user_agent", + "actor", + "action", + "user_id", + "@timestamp", + "created_at", + "user", + "operation_type", + "org_id", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "policy", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "actor", + "actor_id", + "user_agent", + "policy", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "limit", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "policy", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "actor", + "actor_id", + "user_agent", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "org_id", + "created_at", + "_document_id", + "user", + "user_id", + "action", + "actor_id", + "old_permission", + "permission", + "actor", + "user_agent", + "operation_type", + "org" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "action", + "@timestamp", + "actor_id", + "permission", + "created_at", + "user_agent", + "org", + "org_id", + "_document_id", + "visibility", + "operation_type" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "actor_id", + "permission", + "action", + "org_id", + "actor", + "created_at", + "_document_id", + "business_id", + "operation_type", + "org", + "user_agent", + "business", + "@timestamp" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "owner_type", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "owner_type", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "user_agent", + "actor", + "actor_id", + "owner", + "owner_type", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "passkey.register", "description": "A new passkey was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "nickname", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "passkey.remove", "description": "A new passkey was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "nickname", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "user", + "operation_type", + "user_id", + "_document_id", + "action", + "actor", + "actor_id", + "@timestamp", + "created_at" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "created_at", + "actor_id", + "@timestamp", + "user_id", + "action", + "operation_type", + "actor", + "_document_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "org_id", + "created_at", + "actor_id", + "@timestamp", + "action", + "actor", + "org", + "user_agent", + "_document_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "repository_selection", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "repository_selection", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.create", "description": "Triggered when you create a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "user", + "user_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.credential_regenerated", "description": "Triggered when you regenerate a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.credential_revoked", "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", - "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users" + "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", + "fields": [ + "user_programmatic_access_name", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.destroy", "description": "Triggered when you delete a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "user", + "user_id", + "explanation", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "org", + "org_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "user", + "user_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user_programmatic_access_name", + "org", + "org_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "personal_access_token.update", "description": "A fine-grained personal access token was updated.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user_programmatic_access_name", + "user", + "user_id", + "repository_selection", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "name", + "runner_group_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "user", + "actor_id", + "user_id", + "@timestamp", + "created_at", + "owner", + "action", + "_document_id", + "user_agent", + "actor", + "operation_type" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "actor", + "user_agent", + "operation_type", + "user", + "created_at", + "user_id", + "action", + "_document_id", + "@timestamp" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "org_id", + "user_agent", + "operation_type", + "@timestamp", + "created_at", + "repo_id", + "org", + "_document_id", + "action", + "actor", + "actor_id", + "repo" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user", + "_document_id", + "user_id", + "user_agent", + "@timestamp", + "actor_id", + "action", + "created_at", + "actor" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "actor_id", + "operation_type", + "actor", + "user_id", + "@timestamp", + "created_at", + "_document_id", + "user_agent", + "user" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo_id", + "action", + "actor_id", + "org_id", + "user_agent", + "actor", + "operation_type", + "@timestamp", + "_document_id", + "created_at", + "org", + "repo" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "actor", + "actor_id", + "action", + "user_id", + "_document_id", + "user_agent", + "operation_type", + "user", + "@timestamp", + "created_at" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "created_at", + "actor_id", + "old_name", + "operation_type", + "@timestamp", + "repo", + "_document_id", + "user_agent", + "org_id", + "business_id", + "actor", + "repo_id", + "org", + "business" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "repo_id", + "operation_type", + "actor", + "action", + "created_at", + "actor_id", + "_document_id", + "@timestamp", + "user_agent", + "org", + "org_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "org", + "@timestamp", + "_document_id", + "operation_type", + "created_at", + "actor_id", + "action", + "org_id", + "user_agent" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "org_id", + "operation_type", + "org", + "actor_id", + "_document_id", + "team", + "@timestamp", + "action", + "user_agent", + "actor" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "operation_type", + "@timestamp", + "actor_id", + "user", + "user_agent", + "actor", + "created_at", + "org", + "_document_id", + "org_id", + "action", + "programmatic_access_type" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "merge_queue_enforcement_level", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "read_only", + "user_agent", + "actor_id", + "operation_type", + "created_at", + "_document_id", + "key", + "fingerprint", + "actor", + "action", + "user", + "user_id", + "@timestamp", + "title", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "fingerprint", + "user_agent", + "read_only", + "explanation", + "repo", + "@timestamp", + "action", + "key", + "operation_type", + "_document_id", + "actor", + "title", + "actor_id", + "repo_id", + "created_at", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "user_agent", + "title", + "key", + "fingerprint", + "read_only", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "token_scopes" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "created_at", + "operation_type", + "_document_id", + "title", + "key", + "action", + "actor", + "read_only", + "explanation", + "repo_id", + "@timestamp", + "actor_id", + "repo", + "user_agent", + "fingerprint" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "actor", + "user_agent", + "key", + "fingerprint", + "read_only", + "repo_id", + "operation_type", + "created_at", + "actor_id", + "repo", + "action", + "_document_id", + "title", + "@timestamp", + "programmatic_access_type" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "repo_id", + "actor", + "key", + "fingerprint", + "@timestamp", + "actor_id", + "oauth_application_id", + "title", + "action", + "user_agent", + "created_at", + "repo", + "read_only", + "operation_type", + "_document_id", + "user", + "user_id", + "programmatic_access_type" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "operation_type", + "user", + "@timestamp", + "_document_id", + "action", + "created_at", + "key", + "fingerprint", + "actor_id", + "actor", + "title", + "user_agent", + "user_id", + "read_only", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "repo_id", + "user", + "operation_type", + "@timestamp", + "actor_id", + "user_id", + "created_at", + "user_agent", + "actor", + "action", + "repo", + "visibility", + "_document_id", + "previous_visibility", + "programmatic_access_type" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "visibility", + "repo", + "created_at", + "user_agent", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "actor_id", + "repo_id", + "user", + "action", + "user_id", + "oauth_application_id", + "org", + "org_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "action", + "user_agent", + "actor", + "repo", + "repo_id", + "user", + "org", + "org_id", + "actor_id", + "topic", + "@timestamp", + "_document_id", + "user_id", + "created_at", + "operation_type", + "programmatic_access_type" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "repo_id", + "user_agent", + "user_id", + "created_at", + "@timestamp", + "repo", + "user", + "operation_type", + "visibility", + "action", + "actor_id", + "actor", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "oauth_application_id", + "user_agent", + "created_at", + "@timestamp", + "_document_id", + "actor_id", + "operation_type", + "action", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "tool", + "category" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "actor", + "actor_id", + "user_agent", + "tool", + "branch", + "category", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "business", + "business_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo_id", + "_document_id", + "action", + "created_at", + "repo", + "operation_type", + "@timestamp" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "repo", + "@timestamp", + "actor", + "_document_id", + "user_agent", + "actor_id", + "repo_id", + "action", + "operation_type", + "created_at" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "actor", + "repo_id", + "action", + "user_agent", + "_document_id", + "@timestamp", + "created_at", + "actor_id", + "repo", + "operation_type" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "actor", + "oauth_application_id", + "created_at", + "action", + "repo_id", + "repo", + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "operation_type" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "user_agent", + "operation_type", + "created_at", + "actor", + "org", + "action", + "actor_id", + "repo", + "repo_id", + "org_id", + "@timestamp", + "_document_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "actor", + "operation_type", + "created_at", + "user_agent", + "action", + "actor_id", + "repo", + "repo_id", + "@timestamp", + "_document_id" + ] }, { "action": "repo.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "oauth_application_id", + "token_id", + "token_scopes", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "repo", + "user_id", + "visibility", + "repo_id", + "user", + "actor_id", + "action", + "operation_type", + "request_category", + "@timestamp", + "created_at", + "_document_id", + "actor", + "user_agent", + "org", + "oauth_application_id", + "org_id", + "request_method", + "business", + "business_id", + "public_repo", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "visibility", + "integration", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "repo", + "_document_id", + "user_agent", + "user_id", + "actor", + "action", + "user", + "repo_id", + "operation_type", + "request_category", + "actor_id", + "visibility", + "created_at", + "@timestamp", + "request_method", + "oauth_application_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "@timestamp", + "visibility", + "repo", + "repo_id", + "user", + "actor_id", + "user_agent", + "user_id", + "created_at", + "_document_id", + "action", + "operation_type", + "programmatic_access_type" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user", + "_document_id", + "user_id", + "visibility", + "action", + "user_agent", + "operation_type", + "repo_id", + "created_at", + "@timestamp", + "actor", + "repo", + "programmatic_access_type" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "user_id", + "action", + "user", + "repo", + "user_agent", + "_document_id", + "actor_id", + "@timestamp", + "actor", + "visibility", + "operation_type", + "repo_id", + "programmatic_access_type" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "actor_id", + "repo_id", + "_document_id", + "user_agent", + "actor", + "visibility", + "user_id", + "repo", + "@timestamp", + "operation_type", + "action", + "created_at", + "programmatic_access_type" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "user_agent", + "user_id", + "created_at", + "visibility", + "actor", + "actor_id", + "user", + "operation_type", + "repo_id", + "action", + "repo", + "_document_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "repo.pages_soft_delete", "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.pages_soft_delete_restore", "description": "A GitHub Pages site that was previously soft-deleted was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "actor_id", + "operation_type", + "user_agent", + "actor", + "@timestamp", + "repo_id", + "user", + "_document_id", + "visibility", + "repo", + "created_at", + "action", + "programmatic_access_type" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "actor_id", + "repo", + "operation_type", + "action", + "@timestamp", + "actor", + "user_agent", + "created_at", + "_document_id", + "repo_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "integration", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "user", + "business", + "action", + "actor_id", + "org", + "org_id", + "actor", + "created_at", + "repo_id", + "user_agent", + "business_id", + "user_id", + "operation_type", + "@timestamp", + "_document_id", + "visibility", + "repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "actor_id", + "repo_id", + "@timestamp", + "_document_id", + "repo", + "org_id", + "action", + "operation_type", + "user_agent", + "actor", + "created_at", + "org", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "action", + "repo_id", + "user_agent", + "topic", + "operation_type", + "user_id", + "org", + "org_id", + "actor", + "business", + "repo", + "@timestamp", + "created_at", + "_document_id", + "actor_id", + "business_id", + "programmatic_access_type" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "user_agent", + "@timestamp", + "actor_id", + "actor", + "old_name", + "repo", + "user_id", + "created_at", + "user", + "action", + "operation_type", + "visibility", + "repo_id", + "_document_id", + "programmatic_access_type" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "action", + "_document_id", + "actor_id", + "user", + "operation_type", + "user_agent", + "repo_id", + "@timestamp", + "created_at", + "actor", + "user_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "policy", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "public_repo" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "policy", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "limit", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "repo", + "repo_id", + "public_repo", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "policy", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "actor", + "actor_id", + "user_agent", + "visibility", + "repo", + "repo_id", + "public_repo", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "created_at", + "actor", + "repo_id", + "action", + "org", + "org_id", + "repo", + "operation_type" + ] }, { "action": "repo.temporary_access_granted", "description": "Temporary access was enabled for a repository.", - "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "repo", + "repo_id", + "public_repo", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "user_id", + "_document_id", + "actor_id", + "repo_id", + "owner", + "user", + "old_user", + "action", + "operation_type", + "created_at", + "user_agent", + "repo", + "visibility", + "repo_was", + "actor" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "visibility", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "public_repo" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "operation_type", + "user_id", + "user", + "action", + "user_agent", + "created_at", + "actor", + "visibility", + "repo_id", + "actor_id", + "repo" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "actor", + "actor_id", + "repo", + "operation_type", + "created_at", + "_document_id", + "repo_id", + "user", + "@timestamp", + "visibility", + "user_agent", + "user_id", + "action", + "programmatic_access_type" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "policy", + "old_policy", + "repo", + "repo_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "oauth_application_id", + "key", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "business", + "business_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "new_policy", + "old_policy", + "updated_access_policy", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "visibility", + "repo", + "repo_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "key", + "visibility", + "integration", + "repo", + "repo_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "action", + "_document_id", + "actor", + "repo_id", + "created_at", + "oauth_application_id", + "user", + "@timestamp", + "repo", + "operation_type", + "org_id", + "actor_id", + "visibility", + "old_permission", + "org", + "user_id", + "old_base_role", + "old_repo_permission", + "old_repo_base_role", + "new_repo_base_role", + "new_repo_permission", + "token_scopes", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "operation_type", + "created_at", + "actor_id", + "repo_id", + "action", + "actor", + "content_type", + "repo", + "@timestamp", + "_document_id", + "user", + "user_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "content_type", + "created_at", + "actor_id", + "user_id", + "operation_type", + "_document_id", + "actor", + "repo_id", + "user_agent", + "repo", + "user", + "action", + "@timestamp" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "created_at", + "repo", + "invitee", + "operation_type", + "actor", + "repo_id", + "_document_id", + "action", + "user_agent", + "inviter", + "@timestamp", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "inviter", + "action", + "operation_type", + "_document_id", + "repo_id", + "repo", + "@timestamp", + "user_agent", + "invitee", + "created_at", + "actor", + "actor_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "actor", + "actor_id", + "@timestamp", + "invitee", + "action", + "inviter", + "repo", + "created_at", + "user_agent", + "repo_id", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "repo", + "_document_id", + "actor", + "invitee", + "action", + "@timestamp", + "actor_id", + "operation_type", + "created_at", + "inviter", + "user_agent", + "repo_id" + ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "ruleset_id", + "ruleset_name", + "ruleset_enforcement", + "ruleset_source_type", + "ruleset_rules", + "ruleset_conditions", + "ruleset_bypass_actors" + ] }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", + "fields": [ + "actor", + "actor_id", + "user_agent", + "name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", + "fields": [ + "actor", + "actor_id", + "user_agent", + "old_name", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type", + "business", + "business_id", + "ruleset_id", + "ruleset_name", + "ruleset_enforcement", + "ruleset_source_type", + "ruleset_rules_updated", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_old_enforcement", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_old_name", + "ruleset_conditions_updated", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "actor_is_bot" + ] }, { "action": "security_key.register", "description": "A security key was registered for an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user", + "created_at", + "user_id", + "action", + "operation_type", + "@timestamp", + "_document_id", + "actor", + "user_agent" + ] }, { "action": "security_key.remove", "description": "A security key was removed from an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "user_id", + "operation_type", + "_document_id", + "user_agent", + "@timestamp", + "actor_id", + "action", + "created_at", + "user" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "action", + "created_at", + "_document_id", + "actor", + "user_agent", + "actor_id", + "operation_type" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "operation_type", + "_document_id", + "created_at", + "actor", + "user", + "action", + "actor_id", + "user_id", + "@timestamp" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "actor", + "user_id", + "action", + "@timestamp", + "user_agent", + "user", + "operation_type", + "created_at", + "actor_id", + "_document_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "active", + "user", + "user_id", + "actor", + "actor_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "actor_id", + "action", + "@timestamp", + "user_id", + "created_at", + "user", + "_document_id", + "user_agent", + "actor", + "operation_type" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "user_id", + "actor", + "actor_id", + "action", + "user", + "operation_type", + "@timestamp", + "_document_id", + "created_at" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "user_id", + "action", + "user_agent", + "actor", + "user", + "operation_type", + "@timestamp", + "created_at", + "actor_id", + "_document_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "user_id", + "operation_type", + "actor_id", + "@timestamp", + "_document_id", + "user", + "action", + "created_at", + "user_agent", + "actor" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "actor_id", + "operation_type", + "created_at", + "user_agent", + "actor", + "action", + "_document_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "created_at", + "user", + "action", + "user_agent", + "operation_type", + "_document_id", + "actor", + "actor_id", + "user_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "user_agent", + "user", + "@timestamp", + "actor_id", + "user_id", + "_document_id", + "actor", + "action", + "operation_type", + "created_at" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "operation_type", + "actor", + "user_id", + "action", + "@timestamp", + "_document_id", + "user_agent", + "actor_id", + "user", + "created_at" + ] }, { "action": "sponsors.sponsored_developer_update_newsletter_send", "description": "Triggered when you send an email update to your sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", + "fields": [ + "actor", + "action", + "user_agent", + "operation_type", + "_document_id", + "created_at", + "actor_id", + "user", + "user_id", + "@timestamp" + ] }, { "action": "sponsors.sponsors_patreon_user_create", "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", + "fields": [ + "actor", + "actor_id", + "user_agent", + "patreon_email", + "patreon_username", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.sponsors_patreon_user_destroy", "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", + "fields": [ + "actor", + "actor_id", + "user_agent", + "patreon_email", + "patreon_username", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "repo", + "repo_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "sponsors.waitlist_join", "description": "You join the waitlist to join GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "actor", + "user_id", + "user_agent", + "actor_id", + "action", + "operation_type", + "created_at", + "user", + "@timestamp", + "_document_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "successor_invitation.accept", "description": "Triggered when you accept a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "successor_invitation.cancel", "description": "Triggered when you cancel a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "successor_invitation.create", "description": "Triggered when you create a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "successor_invitation.decline", "description": "Triggered when you decline a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "successor_invitation.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "successor_invitation.revoke", "description": "Triggered when you revoke a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "user_agent", + "actor", + "actor_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "trusted_device.register", "description": "A new trusted device was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "trusted_device.remove", "description": "A trusted device was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "two_factor_account_recovery.abort", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "action", + "user_id", + "@timestamp", + "_document_id", + "user", + "user_agent", + "operation_type" + ] }, { "action": "two_factor_account_recovery.complete", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "created_at", + "user_id", + "operation_type", + "user", + "_document_id", + "user_agent", + "action" + ] }, { "action": "two_factor_account_recovery.ignore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "created_at", + "user_id", + "operation_type", + "@timestamp", + "user", + "action" + ] }, { "action": "two_factor_account_recovery.staff_approve", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "actor", + "actor_id", + "@timestamp", + "user", + "user_id", + "user_agent", + "operation_type", + "action", + "_document_id" + ] }, { "action": "two_factor_account_recovery.staff_decline", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "actor", + "action", + "@timestamp", + "user_agent", + "operation_type", + "user", + "created_at", + "actor_id", + "_document_id" + ] }, { "action": "two_factor_account_recovery.start", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "operation_type", + "@timestamp", + "user_agent", + "created_at", + "user_id", + "action", + "_document_id" + ] }, { "action": "two_factor_account_recovery.two_factor_destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user_id", + "action", + "@timestamp", + "created_at", + "user_agent", + "user", + "_document_id" + ] }, { "action": "two_factor_authentication.add_factor", "description": "A secondary authentication factor was added to a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "two_factor_authentication.disabled", "description": "Two-factor authentication was disabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", + "fields": [ + "actor", + "action", + "_document_id", + "user_agent", + "user", + "user_id", + "actor_id", + "created_at", + "operation_type", + "@timestamp" + ] }, { "action": "two_factor_authentication.enabled", "description": "Two-factor authentication was enabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "actor", + "operation_type", + "user_agent", + "action", + "created_at", + "actor_id", + "@timestamp", + "user", + "user_id", + "_document_id" + ] }, { "action": "two_factor_authentication.password_reset_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "created_at", + "user", + "user_id", + "action", + "@timestamp", + "_document_id", + "user_agent" + ] }, { "action": "two_factor_authentication.recovery_codes_regenerated", "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "operation_type", + "_document_id", + "user_id", + "action", + "user", + "user_agent", + "actor_id", + "@timestamp", + "created_at" + ] }, { "action": "two_factor_authentication.remove_factor", "description": "A secondary authentication factor was removed from a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "two_factor_authentication.sign_in_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "user_id", + "user", + "user_agent", + "created_at", + "_document_id", + "action", + "@timestamp" + ] }, { "action": "two_factor_authentication.update_fallback", "description": "The two-factor authentication fallback for a user account was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "created_at", + "_document_id", + "user", + "user_id", + "operation_type", + "user_agent", + "action", + "actor", + "actor_id" + ] }, { "action": "user.add_email", "description": "An email address was added to a user account.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", + "fields": [ + "action", + "user", + "user_id", + "user_agent", + "operation_type", + "_document_id", + "actor_id", + "actor", + "email", + "@timestamp", + "created_at" + ] }, { "action": "user.async_delete", "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "user_id", + "created_at", + "user", + "@timestamp", + "_document_id", + "actor_id", + "operation_type", + "user_agent", + "action" + ] }, { "action": "user.audit_log_export", "description": "Audit log entries were exported.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user", + "action", + "actor", + "@timestamp", + "_document_id", + "user_agent", + "user_id", + "operation_type", + "created_at" + ] }, { "action": "user.block_user", "description": "A user was blocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "actor", + "user_id", + "_document_id", + "actor_id", + "@timestamp", + "user_agent", + "user", + "blocked_user", + "operation_type", + "created_at", + "programmatic_access_type" + ] }, { "action": "user.change_password", "description": "A user changed their password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "user_agent", + "actor_id", + "operation_type", + "actor", + "user", + "user_id", + "action", + "created_at", + "_document_id" + ] }, { "action": "user.codespaces_trusted_repo_access_granted", "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "programmatic_access_type" + ] }, { "action": "user.codespaces_trusted_repo_access_revoked", "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "user.create", "description": "A new user account was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "email", + "user_id", + "operation_type", + "@timestamp", + "user", + "created_at", + "_document_id", + "user_agent", + "actor", + "actor_id", + "action", + "programmatic_access_type" + ] }, { "action": "user.create_integration_secret", "description": "A user secret for Codespaces was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "integration", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "user.creation_rate_limit_exceeded", "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "created_at", + "user_agent", + "_document_id", + "operation_type", + "oauth_application_id", + "action", + "actor", + "actor_id", + "user_id", + "@timestamp", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "user.delete", "description": "A user account was destroyed by an asynchronous job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "created_at", + "user_agent", + "action", + "user_id", + "actor", + "actor_id", + "user", + "@timestamp", + "_document_id" + ] }, { "action": "user.demote", "description": "A site administrator was demoted to an ordinary user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "oauth_application_id", + "action", + "user", + "created_at", + "user_agent", + "actor", + "actor_id", + "operation_type", + "_document_id", + "user_id", + "programmatic_access_type" + ] }, { "action": "user.destroy", "description": "A user deleted his or her account, triggering user.async_delete.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "user", + "_document_id", + "created_at", + "user_agent", + "user_id", + "operation_type", + "actor_id", + "action", + "@timestamp" + ] }, { "action": "user.device_verification_failure", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "created_at", + "_document_id", + "@timestamp", + "user", + "user_agent", + "user_id", + "actor_id", + "action", + "operation_type" + ] }, { "action": "user.device_verification_requested", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "user_id", + "actor", + "operation_type", + "created_at", + "_document_id", + "@timestamp", + "user", + "actor_id", + "action" + ] }, { "action": "user.device_verification_success", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "user", + "_document_id", + "action", + "operation_type", + "user_agent", + "created_at", + "actor", + "actor_id", + "user_id" + ] }, { "action": "user.disable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "user.disable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "user.disable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "user.enable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "user.enable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "user.enable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id" + ] }, { "action": "user.failed_login", "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "action", + "operation_type", + "created_at", + "_document_id", + "@timestamp", + "user", + "org_id", + "actor", + "actor_id", + "user_agent" + ] }, { "action": "user.forgot_password", "description": "A user requested a password reset.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", + "fields": [ + "action", + "_document_id", + "user_agent", + "user", + "operation_type", + "@timestamp", + "email", + "created_at", + "user_id" + ] }, { "action": "user.grant_github_developer", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "action", + "created_at", + "user_agent", + "@timestamp", + "_document_id", + "user", + "user_id", + "actor", + "operation_type" + ] }, { "action": "user.hide_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "user_agent", + "actor", + "actor_id", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "user.login", "description": "A user signed in.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "user_id", + "actor_id", + "@timestamp", + "user", + "action", + "operation_type", + "_document_id", + "created_at", + "actor" + ] }, { "action": "user.logout", "description": "A user signed out.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "user.new_device_used", "description": "A user signed in from a new device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "user_id", + "actor", + "operation_type", + "created_at", + "user_agent", + "actor_id", + "action", + "@timestamp", + "_document_id" + ] }, { "action": "user.promote", "description": "An ordinary user account was promoted to a site administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "action", + "actor", + "actor_id", + "user", + "@timestamp", + "created_at", + "user_agent", + "oauth_application_id", + "operation_type", + "_document_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "user.recreate", "description": "A user's account was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "user", + "action", + "actor_id", + "@timestamp", + "_document_id", + "user_id", + "created_at", + "actor", + "operation_type" + ] }, { "action": "user.remove_email", "description": "An email address was removed from a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "action", + "@timestamp", + "_document_id", + "user", + "user_id", + "operation_type", + "actor", + "actor_id", + "created_at", + "email", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "user.remove_integration_secret", "description": "A user secret for Codespaces was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "integration", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "user.rename", "description": "A username was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "action", + "actor_id", + "old_login", + "created_at", + "_document_id", + "actor", + "user_id", + "@timestamp", + "operation_type", + "user_agent", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "user.reset_password", "description": "A user reset their account password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "action", + "user_agent", + "user", + "user_id", + "created_at", + "@timestamp", + "_document_id", + "actor", + "operation_type" + ] }, { "action": "user_session.country_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "created_at", + "user_id", + "action", + "@timestamp", + "_document_id", + "actor", + "actor_id", + "user", + "user_agent", + "operation_type" + ] }, { "action": "user.show_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "user_id", + "action", + "actor", + "user", + "operation_type", + "user_agent", + "actor_id", + "created_at" + ] }, { "action": "user.sign_in_from_unrecognized_device", "description": "A user signed in from an unrecognized device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "action", + "_document_id", + "user_agent", + "user", + "user_id", + "operation_type", + "created_at", + "actor", + "actor_id", + "@timestamp" + ] }, { "action": "user.sign_in_from_unrecognized_device_and_location", "description": "A user signed in from an unrecognized device and location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user", + "user_id", + "@timestamp", + "user_agent", + "created_at", + "_document_id", + "action", + "operation_type" + ] }, { "action": "user_status.destroy", "description": "Triggered when you clear the status on your profile.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "org", + "user_id", + "actor", + "message", + "user", + "actor_id", + "created_at", + "limited_availability", + "action", + "emoji", + "operation_type", + "user_agent", + "@timestamp", + "_document_id" + ] }, { "action": "user_status.update", "description": "Triggered when you set or change the status on your profile.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", + "fields": [ + "limited_availability", + "user", + "action", + "actor_id", + "message", + "user_id", + "created_at", + "_document_id", + "@timestamp", + "user_agent", + "emoji", + "org", + "actor", + "operation_type", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "user.suspend", "description": "A user account was suspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "oauth_application_id", + "operation_type", + "actor_id", + "user", + "user_agent", + "actor", + "created_at", + "_document_id", + "@timestamp", + "user_id", + "action", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "user.toggle_warn_private_email", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "actor_id", + "@timestamp", + "operation_type", + "_document_id", + "user_agent", + "actor", + "action", + "user_id", + "created_at" + ] }, { "action": "user.two_factor_challenge_failure", "description": "A 2FA challenge issued for a user account failed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "operation_type", + "created_at", + "_document_id", + "user_agent", + "user", + "actor_id", + "actor", + "user_id", + "@timestamp", + "action" + ] }, { "action": "user.two_factor_challenge_success", "description": "A 2FA challenge issued for a user account succeeded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "user_id", + "operation_type", + "actor_id", + "user", + "actor", + "user_agent", + "action", + "created_at" + ] }, { "action": "user.two_factor_recover", "description": "A user used their 2FA recovery codes.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "operation_type", + "user_agent", + "user", + "action", + "actor", + "actor_id", + "created_at", + "@timestamp", + "_document_id" + ] }, { "action": "user.two_factor_recovery_codes_downloaded", "description": "A user downloaded 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_id", + "operation_type", + "actor_id", + "user", + "action", + "@timestamp", + "created_at", + "user_agent", + "actor", + "_document_id" + ] }, { "action": "user.two_factor_recovery_codes_printed", "description": "A user printed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user", + "action", + "operation_type", + "user_agent", + "user_id", + "created_at", + "_document_id", + "actor", + "actor_id", + "@timestamp" + ] }, { "action": "user.two_factor_recovery_codes_viewed", "description": "A user viewed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "user_agent", + "actor", + "user_id", + "action", + "created_at", + "user", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "user.two_factor_requested", "description": "A user was prompted for a two-factor authentication code.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", + "fields": [ + "user", + "actor_id", + "action", + "user_agent", + "created_at", + "_document_id", + "user_id", + "operation_type", + "@timestamp", + "actor" + ] }, { "action": "user.unblock_user", "description": "A user was unblocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor_id", + "action", + "_document_id", + "blocked_user", + "operation_type", + "actor", + "@timestamp", + "user_agent", + "user_id", + "user", + "created_at" + ] }, { "action": "user.unsuspend", "description": "A user account was unsuspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "_document_id", + "user", + "action", + "user_agent", + "actor", + "oauth_application_id", + "operation_type", + "actor_id", + "created_at", + "@timestamp", + "user_id", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "user.update_integration_secret", "description": "A user secret for Codespaces was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "key", + "visibility", + "integration", + "user", + "user_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "user.update_new_repository_default_branch_setting", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "created_at", + "user", + "user_id", + "action", + "operation_type", + "@timestamp", + "_document_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "user_agent", + "actor", + "actor_id", + "workflow_run_id", + "run_number", + "user", + "user_id", + "repo", + "repo_id", + "business", + "business_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "token_scopes", + "programmatic_access_type" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "actor", + "actor_id", + "user_agent", + "workflow_run_id", + "run_number", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "token_id", + "hashed_token", + "programmatic_access_type", + "actor", + "actor_id", + "workflow_run_id", + "run_number", + "repo", + "repo_id", + "public_repo", + "org", + "org_id", + "action", + "_document_id", + "@timestamp", + "created_at", + "operation_type" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "workflow_run_id", + "started_at", + "head_branch", + "head_sha", + "trigger_id", + "programmatic_access_type" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "workflow_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type", + "actor_is_bot" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "user_agent", + "actor", + "actor_id", + "repo", + "repo_id", + "workflow_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "user_agent", + "actor", + "actor_id", + "workflow_run_id", + "run_number", + "user", + "user_id", + "repo", + "repo_id", + "action", + "operation_type", + "@timestamp", + "created_at", + "_document_id", + "public_repo", + "programmatic_access_type" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.10/enterprise.json b/src/audit-logs/data/ghes-3.10/enterprise.json index ad0ec044dfef..f0458b8620e0 100644 --- a/src/audit-logs/data/ghes-3.10/enterprise.json +++ b/src/audit-logs/data/ghes-3.10/enterprise.json @@ -2,3221 +2,116735 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.confirm", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.recover", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "api.request", "description": "An API request was made to a security-significant endpoint for the enterprise. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "query_string", + "rate_limit_remaining", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_body", + "request_cancelled", + "request_method", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "route", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "status_code", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url_path", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.update_bill_cycle_day", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.add_admin", "description": "An enterprise owner was added to an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.add_organization", "description": "An organization was added to an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.disabled", "description": "GitHub Advanced Security was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.enabled", "description": "GitHub Advanced Security was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.advanced_security_policy_update", "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.advanced_security_repo_admin_enablement_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_actions_settings", "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_default_repository_permission", "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_members_can_create_repos", "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.create", "description": "An enterprise was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for new repositories in your enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for new repositories in your enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.dependabot_alerts_repo_admin_enablement_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.disable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the enterprise was disabled.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.disable_two_factor_requirement", "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.enable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the enterprise was enabled.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.enable_two_factor_requirement", "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.clear", "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.remove_admin", "description": "An enterprise owner was removed from an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.remove_organization", "description": "An organization was removed from an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.rename_slug", "description": "The slug for the enterprise URL was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.create", "description": "An enterprise-level custom pattern was created for secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.delete", "description": "An enterprise-level custom pattern was removed from secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.publish", "description": "An enterprise-level custom pattern was published for secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.update", "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.disable", "description": "Secret scanning was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.disabled_for_new_repos", "description": "Secret scanning was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.enable", "description": "Secret scanning was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.enabled_for_new_repos", "description": "Secret scanning was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.disable", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.enable", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.update", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.disable", "description": "Push protection for secret scanning was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.disabled_for_new_repos", "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.enable", "description": "Push protection for secret scanning was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.enabled_for_new_repos", "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.secret_scanning_repo_admin_settings_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_fork_pr_approvals_policy", "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_actions_settings", "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_default_repository_permission", "description": "The base repository permission setting was updated for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_member_repository_creation_permission", "description": "The repository creation setting was updated for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_member_repository_invitation_permission", "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.destroy", "description": "Triggered when a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.destroy", "description": "Triggered when a reply to a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.update", "description": "Triggered when a reply to a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.update", "description": "Triggered when a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.create", "description": "A global announcement banner was created for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.destroy", "description": "A global announcement banner was removed from the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.update", "description": "A global announcement banner was updated for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.approve", "description": "A domain was approved for an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.create", "description": "A domain was added to an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.destroy", "description": "A domain was removed from an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.verify", "description": "A domain was verified for an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.register_self_hosted_runner", "description": "A new GitHub Actions self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.remove_self_hosted_runner", "description": "A GitHub Actions self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_created", "description": "A GitHub Actions self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_removed", "description": "A GitHub Actions self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runner_removed", "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runners_added", "description": "A GitHub Actions self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runners_updated", "description": "A GitHub Actions runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_updated", "description": "The configuration of a GitHub Actions self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_offline", "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_online", "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_updated", "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git.clone", "description": "A repository was cloned.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.fetch", "description": "Changes were fetched from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.push", "description": "Changes were pushed to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git_signing_ssh_public_key.create", "description": "An SSH key was added to a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.delete", "description": "An SSH key was removed from a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable", "description": "An IP allow list was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_for_installed_apps", "description": "An IP allow list was disabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_user_level_enforcement", "description": "IP allow list user level enforcement was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable", "description": "An IP allow list was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_for_installed_apps", "description": "An IP allow list was enabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_user_level_enforcement", "description": "IP allow list user level enforcement was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.create", "description": "An IP address was added to an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.destroy", "description": "An IP address was deleted from an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.update", "description": "An IP address or its description was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.publish", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.retire", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.create", "description": "An OAuth access token was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.destroy", "description": "An OAuth access token was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.regenerate", "description": "An OAuth access token was regenerated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.update", "description": "An OAuth access token was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.suspend", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.unsuspend", "description": "An OAuth application was unsuspended for a user or organization account.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.create", "description": "An authorization for an OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.destroy", "description": "An authorization for an OAuth application was deleted.", - "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations" + "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.update", "description": "An authorization for an OAuth application was updated.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.accept_business_invitation", "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_billing_manager", "description": "A billing manager was added to an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_disabled", "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_enabled", "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.async_delete", "description": "A user initiated a background job to delete an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.audit_log_export", "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.billing_signup_error", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.block_user", "description": "An organization owner blocked a user from accessing the organization's repositories.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_business_invitation", "description": "An invitation for an organization to join an enterprise was revoked", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_invitation", "description": "An invitation sent to a user to join an organization was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.clear_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_enabled", "description": "Code scanning using the default setup was enabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.confirm_business_invitation", "description": "An invitation for an organization to join an enterprise was confirmed.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create", "description": "An organization was created.", - "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" + "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.delete", "description": "An organization was deleted by a user-initiated background job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_member_team_creation_permission", "description": "Team creation was limited to owners.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_reader_discussion_creation_permission", "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_saml", "description": "SAML single sign-on was disabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_two_factor_requirement", "description": "A two-factor authentication requirement was disabled for the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_disabled", "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_enabled", "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_member_team_creation_permission", "description": "Team creation by members was allowed.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_reader_discussion_creation_permission", "description": "An organization owner allowed users with read access to create discussions in an organization", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_saml", "description": "SAML single sign-on was enabled for the organization.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_two_factor_requirement", "description": "Two-factor authentication is now required for the organization.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_added", "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_removed", "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_member", "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_to_business", "description": "An organization was invited to join an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rate_limited_invites", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recreate", "description": "An organization was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_billing_manager", "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_outside_collaborator", "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rename", "description": "An organization was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.restore_member", "description": "An organization member was restored.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_created", "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_removed", "description": "A self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runner_removed", "description": "The REST API was used to remove a self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_added", "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_updated", "description": "A runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_updated", "description": "The configuration of a self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_disabled", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_enabled", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_updated", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_disable", "description": "Push protection for secret scanning was disabled.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_enable", "description": "Push protection for secret scanning was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_disable", "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_enable", "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transform", "description": "A user account was converted into an organization.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.unblock_user", "description": "A user was unblocked from an organization.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_settings", "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_default_repository_permission", "description": "The default repository permission level for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_saml_provider_settings", "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_terms_of_service", "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", - "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" + "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.approve", "description": "A domain was approved for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.create", "description": "A domain was added to an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.destroy", "description": "A domain was removed from an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.verify", "description": "A domain was verified for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_deleted", "description": "An entire package was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_published", "description": "A package was published or republished to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_deleted", "description": "A specific package version was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_published", "description": "A specific package version was published or republished to a package.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.register", "description": "A new passkey was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.remove", "description": "A new passkey was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.create", "description": "Triggered when you create a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_regenerated", "description": "Triggered when you regenerate a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_revoked", "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", - "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users" + "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.destroy", "description": "Triggered when you delete a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.update", "description": "A fine-grained personal access token was updated.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.authorized_users_teams", "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.create", "description": "Branch protection was enabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.destroy", "description": "Branch protection was disabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismiss_stale_reviews", "description": "Enforcement of dismissing stale pull requests was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismissal_restricted_users_teams", "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.policy_override", "description": "A branch protection requirement was overridden by a repository administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "after", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "before", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "compliant_pull_request_ids", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "overridden_codes", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reasons", + "referrer", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.rejected_ref_update", "description": "A branch update attempt was rejected.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_admin_enforced", "description": "Branch protection was enforced for repository administrators.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_deletions_enforcement_level", "description": "Branch deletion was enabled or disabled for a protected branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_force_pushes_enforcement_level", "description": "Force pushes were enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_ignore_approvals_from_contributors", "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_linear_history_requirement_enforcement_level", "description": "Required linear commit history was enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_allows_fetch_and_merge", "description": "Fork syncing was enabled or disabled for a read-only branch", - "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_branch_enforcement_level", "description": "The enforcement of a branch lock was updated.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_name", "description": "A branch name pattern was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_pull_request_reviews_enforcement_level", "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_code_owner_review", "description": "Enforcement of required code owner review was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_last_push_approval", "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_approving_review_count", "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_status_checks_enforcement_level", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_signature_requirement_enforcement_level", "description": "Enforcement of required commit signing was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_strict_required_status_checks_policy", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.close", "description": "A pull request was closed without being merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.converted_to_draft", "description": "A pull request was converted to a draft.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create", "description": "A pull request was created.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create_review_request", "description": "A review was requested on a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.in_progress", "description": "A pull request was marked as in progress.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.indirect_merge", "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.merge", "description": "A pull request was merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.ready_for_review", "description": "A pull request was marked as ready for review.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.rebase", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.remove_review_request", "description": "A review request was removed from a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.reopen", "description": "A pull request was reopened after previously being closed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.create", "description": "A review comment was added to a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.delete", "description": "A review comment on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.update", "description": "A review comment on a pull request was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.delete", "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.dismiss", "description": "A review on a pull request was dismissed.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.submit", "description": "A review on a pull request was submitted.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_disabled", "description": "Code scanning using the default setup was disabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_enabled", "description": "Code scanning using the default setup was enabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.disk_archive", "description": "A repository was archived on disk.", - "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories" + "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.download_zip", "description": "A source code archive of a repository was downloaded as a ZIP file.", - "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives" + "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.hide_from_discovery", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.noindex", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.override_unlock", "description": "The repository was unlocked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_build", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.require_login", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.temporary_access_granted", "description": "Temporary access was enabled for a repository.", - "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.disable", "description": "Secret scanning was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.enable", "description": "Secret scanning was enabled for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.disable", "description": "Secret scanning push protection was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.enable", "description": "Secret scanning push protection was enabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.disable", "description": "Email notification restrictions for an organization or enterprise were disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.enable", "description": "Email notification restrictions for an organization or enterprise were enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.create", "description": "GitHub detected a secret and created a secret scanning alert.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.reopen", "description": "A seret scanning alert was reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.resolve", "description": "A seret scanning alert was resolved.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.revoke", "description": "A secret scanning alert was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.disable", "description": "Secret scanning was disabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.enable", "description": "Secret scanning was enabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.disable", "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.enable", "description": "Secret scanning was enabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_push_protection.bypass", "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.register", "description": "A security key was registered for an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.remove", "description": "A security key was removed from an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_update_newsletter_send", "description": "Triggered when you send an email update to your sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.waitlist_join", "description": "You join the waitlist to join GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.create", "description": "An SSH certificate authority for an organization or enterprise was created.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.destroy", "description": "An SSH certificate authority for an organization or enterprise was deleted.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.disable", "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.enable", "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.set_domain_token_expiration", "description": "The verification code expiry time for an organization or enterprise domain was set.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.unverify_domain", "description": "An organization or enterprise domain was unverified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.verify_domain", "description": "An organization or enterprise domain was verified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.accept", "description": "Triggered when you accept a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.cancel", "description": "Triggered when you cancel a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.create", "description": "Triggered when you create a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.decline", "description": "Triggered when you decline a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.revoke", "description": "Triggered when you revoke a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_member", "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_repository", "description": "A team was given access and permissions to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_parent_team", "description": "A child team was created or a child team's parent was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" + "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_privacy", "description": "A team's privacy level was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility" + "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.create", "description": "A new team is created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.demote_maintainer", "description": "A user was demoted from a team maintainer to a team member.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.destroy", "description": "A team was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.clear", "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.disable", "description": "Team discussions were disabled for an organization.", - "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization" + "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.enable", "description": "Team discussions were enabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.promote_maintainer", "description": "A user was promoted from a team member to a team maintainer.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_member", "description": "An organization member was removed from a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.rename", "description": "A team's name was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.disabled", "description": "Team synchronization with a tenant was disabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.enabled", "description": "Team synchronization with a tenant was enabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.register", "description": "A new trusted device was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.remove", "description": "A trusted device was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.abort", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.complete", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.ignore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_approve", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_decline", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.start", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.two_factor_destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.add_factor", "description": "A secondary authentication factor was added to a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.disabled", "description": "Two-factor authentication was disabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.enabled", "description": "Two-factor authentication was enabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.password_reset_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.recovery_codes_regenerated", "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.remove_factor", "description": "A secondary authentication factor was removed from a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.sign_in_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.update_fallback", "description": "The two-factor authentication fallback for a user account was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.add_email", "description": "An email address was added to a user account.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.async_delete", "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.audit_log_export", "description": "Audit log entries were exported.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.block_user", "description": "A user was blocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.change_password", "description": "A user changed their password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_granted", "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_revoked", "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_device", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_device_and_location", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_location", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create", "description": "A new user account was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create_integration_secret", "description": "A user secret for Codespaces was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.creation_rate_limit_exceeded", "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.delete", "description": "A user account was destroyed by an asynchronous job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.demote", "description": "A site administrator was demoted to an ordinary user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.destroy", "description": "A user deleted his or her account, triggering user.async_delete.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_failure", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_requested", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_success", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.failed_login", "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.flag_as_large_scale_contributor", "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.forgot_password", "description": "A user requested a password reset.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.grant_github_developer", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.hide_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.login", "description": "A user signed in.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.logout", "description": "A user signed out.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.minimize_comment", "description": "A comment made by a user was minimized.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.new_device_used", "description": "A user signed in from a new device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.partial_two_factor_email_followup", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.promote", "description": "An ordinary user account was promoted to a site administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.recreate", "description": "A user's account was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_email", "description": "An email address was removed from a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_integration_secret", "description": "A user secret for Codespaces was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_large_scale_contributor_flag", "description": "A user account was no longer flagged as a large scale contributor.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.rename", "description": "A username was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.report_abuse", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.report_content", "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.reset_password", "description": "A user reset their account password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_session.country_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.show_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device", "description": "A user signed in from an unrecognized device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device_and_location", "description": "A user signed in from an unrecognized device and location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_location", "description": "A user signed in from an unrecognized location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.destroy", "description": "Triggered when you clear the status on your profile.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.update", "description": "Triggered when you set or change the status on your profile.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.suspend", "description": "A user account was suspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.toggle_warn_private_email", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_failure", "description": "A 2FA challenge issued for a user account failed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_success", "description": "A 2FA challenge issued for a user account succeeded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recover", "description": "A user used their 2FA recovery codes.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_downloaded", "description": "A user downloaded 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_printed", "description": "A user printed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_viewed", "description": "A user viewed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_requested", "description": "A user was prompted for a two-factor authentication code.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unblock_user", "description": "A user was unblocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unminimize_comment", "description": "A comment made by a user was unminimized.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unsuspend", "description": "A user account was unsuspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_integration_secret", "description": "A user secret for Codespaces was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_new_repository_default_branch_setting", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.cancel_workflow_run", "description": "A workflow run was cancelled.", - "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow" + "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.completed_workflow_run", "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history" + "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.created_workflow_run", "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow" + "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.prepared_workflow_job", "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows" + "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.rerun_workflow_run", "description": "A workflow run was re-run.", - "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs" + "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.10/organization.json b/src/audit-logs/data/ghes-3.10/organization.json index ec72ee05e0fc..700dca1c119b 100644 --- a/src/audit-logs/data/ghes-3.10/organization.json +++ b/src/audit-logs/data/ghes-3.10/organization.json @@ -2,2881 +2,104356 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.accept", "description": "Credit was accepted for a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.create", "description": "Someone was added to the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.decline", "description": "Credit was declined for a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.destroy", "description": "Someone was removed from the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "auto_approve_personal_access_token_requests.disable", "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "auto_approve_personal_access_token_requests.enable", "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.attempted_to_create_from_prebuild", "description": "An attempt to create a codespace from a prebuild was made.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.business_enablement_updated", "description": "Enterprise setting for Codespaces ownership was updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_created", "description": "Policies were applied to codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_deleted", "description": "Policies were removed from codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_updated", "description": "Policies were updated for codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "commit_comment.destroy", "description": "A commit comment was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "commit_comment.update", "description": "A commit comment was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_comment.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_comment.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.destroy", "description": "Triggered when a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.destroy", "description": "Triggered when a reply to a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.update", "description": "Triggered when a reply to a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.update", "description": "Triggered when a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_installation.create", "description": "The GitHub App associated with a GitHub Connect connection was created.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_installation.destroy", "description": "The GitHub App associated with a GitHub Connect connection was deleted.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git.clone", "description": "A repository was cloned.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.fetch", "description": "Changes were fetched from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.push", "description": "Changes were pushed to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation_request.close", "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reason", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation_request.create", "description": "A member requested that an owner install a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable", "description": "An IP allow list was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_for_installed_apps", "description": "An IP allow list was disabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable", "description": "An IP allow list was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_for_installed_apps", "description": "An IP allow list was enabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.create", "description": "An IP address was added to an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.destroy", "description": "An IP address was deleted from an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.update", "description": "An IP address or its description was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue_comment.destroy", "description": "A comment on an issue was deleted from the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.destroy", "description": "An issue was deleted from the repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue" + "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.pinned", "description": "An issue was pinned to a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.transfer", "description": "An issue was transferred to another repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.unpinned", "description": "An issue was unpinned from a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_disabled", "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_enabled", "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_policy_cleared", "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_pages.disable", "description": "The ability for members to publish GitHub Pages sites was disabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_pages.enable", "description": "The ability for members to publish GitHub Pages sites was enabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_private_pages.disable", "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_private_pages.enable", "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_public_pages.disable", "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_public_pages.enable", "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.clear", "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.disable", "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.enable", "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.clear", "description": "An enterprise owner cleared the policy setting for viewing dependency insights in any organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.disable", "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.enable", "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.destroy_file", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.download", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.accept_business_invitation", "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_billing_manager", "description": "A billing manager was added to an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_disabled", "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_enabled", "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.allow_third_party_access_requests_from_outside_collaborators_disabled", "description": "Third-party application access for outside collaborators was disabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled", "description": "Third-party application access for outside collaborators was enabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.archive", "description": "The organization was archived.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.audit_log_export", "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.audit_log_git_event_export", "description": "An export of the organization's Git events was created.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.billing_signup_error", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.block_user", "description": "An organization owner blocked a user from accessing the organization's repositories.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_business_invitation", "description": "An invitation for an organization to join an enterprise was revoked", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_invitation", "description": "An invitation sent to a user to join an organization was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.clear_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_enabled", "description": "Code scanning using the default setup was enabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.confirm_business_invitation", "description": "An invitation for an organization to join an enterprise was confirmed.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.connect_usage_metrics_export", "description": "Server statistics were exported for the organization.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create", "description": "An organization was created.", - "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" + "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_actions_secret", "description": "A GitHub Actions secret was created for an organization.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_integration_secret", "description": "An integration secret was created for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.deauthorize", "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.grant", "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.revoke", "description": "An owner revoked authorized credentials.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_member_team_creation_permission", "description": "Team creation was limited to owners.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were disabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_reader_discussion_creation_permission", "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_saml", "description": "SAML single sign-on was disabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the organization was disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_two_factor_requirement", "description": "A two-factor authentication requirement was disabled for the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_disabled", "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_enabled", "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_member_team_creation_permission", "description": "Team creation by members was allowed.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were enabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_reader_discussion_creation_permission", "description": "An organization owner allowed users with read access to create discussions in an organization", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_saml", "description": "SAML single sign-on was enabled for the organization.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the organization was enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_two_factor_requirement", "description": "Two-factor authentication is now required for the organization.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_added", "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_removed", "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_member", "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_to_business", "description": "An organization was invited to join an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_approved", "description": "Access to an organization was granted for an OAuth App.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_denied", "description": "Access was disabled for an OAuth App that was previously approved.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_requested", "description": "An organization member requested that an owner grant an OAuth App access to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rate_limited_invites", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_actions_secret", "description": "A GitHub Actions secret was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_billing_manager", "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_integration_secret", "description": "An integration secret was removed from an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_outside_collaborator", "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rename", "description": "An organization was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_create", "description": "Triggered when a required workflow is created.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_delete", "description": "Triggered when a required workflow is deleted.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_update", "description": "Triggered when a required workflow is updated.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.restore_member", "description": "An organization member was restored.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.revoke_external_identity", "description": "A member's linked identity was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.revoke_sso_session", "description": "A member's SAML session was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_created", "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_removed", "description": "A self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_renamed", "description": "A self-hosted runner group was renamed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runner_removed", "description": "The REST API was used to remove a self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_added", "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_updated", "description": "A runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_updated", "description": "The configuration of a self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_visiblity_updated", "description": "The visibility of a self-hosted runner group was updated via the REST API.", - "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_disabled", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_enabled", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_updated", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_disable", "description": "Push protection for secret scanning was disabled.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_enable", "description": "Push protection for secret scanning was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_disable", "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_enable", "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transfer", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transfer_outgoing", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.unarchive", "description": "The organization was unarchived.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.unblock_user", "description": "A user was unblocked from an organization.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_settings", "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_default_repository_permission", "description": "The default repository permission level for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_integration_secret", "description": "An integration secret was updated for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_new_repository_default_branch_setting", "description": "The name of the default branch was changed for new repositories in the organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_saml_provider_settings", "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_terms_of_service", "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", - "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" + "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.create", "description": "A default label was created for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.destroy", "description": "A default label was deleted for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.update", "description": "A default label was edited for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.approve", "description": "A domain was approved for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.create", "description": "A domain was added to an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.destroy", "description": "A domain was removed from an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.verify", "description": "A domain was verified for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.add_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.add_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.remove_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.remove_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.clear", "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.disable", "description": "Organization projects were disabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.enable", "description": "Organization projects were enabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_deleted", "description": "An entire package was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_published", "description": "A package was published or republished to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_deleted", "description": "A specific package version was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_published", "description": "A specific package version was published or republished to a package.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.create", "description": "A GitHub Codespaces prebuild configuration for a repository was created.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.destroy", "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.run_triggered", "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.update", "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.clear", "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.disable", "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.enable", "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.authorized_users_teams", "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.create", "description": "Branch protection was enabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.destroy", "description": "Branch protection was disabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismiss_stale_reviews", "description": "Enforcement of dismissing stale pull requests was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismissal_restricted_users_teams", "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.policy_override", "description": "A branch protection requirement was overridden by a repository administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "after", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "before", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "compliant_pull_request_ids", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "overridden_codes", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reasons", + "referrer", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.rejected_ref_update", "description": "A branch update attempt was rejected.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_admin_enforced", "description": "Branch protection was enforced for repository administrators.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_deletions_enforcement_level", "description": "Branch deletion was enabled or disabled for a protected branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_force_pushes_enforcement_level", "description": "Force pushes were enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_ignore_approvals_from_contributors", "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_linear_history_requirement_enforcement_level", "description": "Required linear commit history was enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_allows_fetch_and_merge", "description": "Fork syncing was enabled or disabled for a read-only branch", - "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_branch_enforcement_level", "description": "The enforcement of a branch lock was updated.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_name", "description": "A branch name pattern was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_pull_request_reviews_enforcement_level", "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_code_owner_review", "description": "Enforcement of required code owner review was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_last_push_approval", "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_approving_review_count", "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_status_checks_enforcement_level", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_signature_requirement_enforcement_level", "description": "Enforcement of required commit signing was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_strict_required_status_checks_policy", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.close", "description": "A pull request was closed without being merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.converted_to_draft", "description": "A pull request was converted to a draft.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create", "description": "A pull request was created.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create_review_request", "description": "A review was requested on a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.in_progress", "description": "A pull request was marked as in progress.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.indirect_merge", "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.merge", "description": "A pull request was merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.ready_for_review", "description": "A pull request was marked as ready for review.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.rebase", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.remove_review_request", "description": "A review request was removed from a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.reopen", "description": "A pull request was reopened after previously being closed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.create", "description": "A review comment was added to a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.delete", "description": "A review comment on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.update", "description": "A review comment on a pull request was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.delete", "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.dismiss", "description": "A review on a pull request was dismissed.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.submit", "description": "A review on a pull request was submitted.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_disabled", "description": "Code scanning using the default setup was disabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_enabled", "description": "Code scanning using the default setup was enabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to this repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to this repository was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.download_zip", "description": "A source code archive of a repository was downloaded as a ZIP file.", - "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives" + "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename_branch", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.close", "description": "Someone closed a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.cve_request", "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.github_broadcast", "description": "GitHub made a security advisory public in the GitHub Advisory Database.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.github_withdraw", "description": "GitHub withdrew a security advisory that was published in error.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.open", "description": "Someone opened a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.publish", "description": "Someone published a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.reopen", "description": "Someone reopened as draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.update", "description": "Someone edited a draft or published security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_content_analysis.disable", "description": "Data use settings were disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_content_analysis.enable", "description": "Data use settings were enabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_dependency_graph.disable", "description": "The dependency graph was disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_dependency_graph.enable", "description": "The dependency graph was enabled for a private repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.clear", "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.disable", "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.enable", "description": "Repository projects were enabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.disable", "description": "Secret scanning was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.enable", "description": "Secret scanning was enabled for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.disable", "description": "Secret scanning push protection was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.enable", "description": "Secret scanning push protection was enabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.clear", "description": "The repository visibility change setting was cleared for an organization or enterprise.", - "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility" + "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.disable", "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.enable", "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.auto_dismiss", "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.auto_reopen", "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.create", "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.dismiss", "description": "A Dependabot alert was manually dismissed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.reintroduce", "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.reopen", "description": "A Dependabot alert was manually reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.resolve", "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.authorized_users_teams", "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts_auto_dismissal.disable", "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts_auto_dismissal.enable", "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.disable", "description": "Dependabot alerts was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.enable", "description": "Dependabot alerts was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "required_status_check.create", "description": "A status check was marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "context", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "required_status_check.destroy", "description": "A status check was no longer marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "context", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.disable", "description": "Email notification restrictions for an organization or enterprise were disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.enable", "description": "Email notification restrictions for an organization or enterprise were enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.create", "description": "A new custom repository role was created.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.destroy", "description": "A custom repository role was deleted.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.update", "description": "A custom repository role was edited.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.create", "description": "GitHub detected a secret and created a secret scanning alert.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.reopen", "description": "A seret scanning alert was reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.resolve", "description": "A seret scanning alert was resolved.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.revoke", "description": "A secret scanning alert was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.disable", "description": "Secret scanning was disabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.enable", "description": "Secret scanning was enabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.disable", "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.enable", "description": "Secret scanning was enabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_push_protection.bypass", "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.invoiced_agreement_sign", "description": "An agreement for invoiced billing for GitHub Sponsors was signed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.create", "description": "An SSH certificate authority for an organization or enterprise was created.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.destroy", "description": "An SSH certificate authority for an organization or enterprise was deleted.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.disable", "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.enable", "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.dependabot_debug_credentials_generated", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.set_domain_token_expiration", "description": "The verification code expiry time for an organization or enterprise domain was set.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.unverify_domain", "description": "An organization or enterprise domain was unverified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.verify_domain", "description": "An organization or enterprise domain was verified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_member", "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_repository", "description": "A team was given access and permissions to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_parent_team", "description": "A child team was created or a child team's parent was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" + "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_privacy", "description": "A team's privacy level was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility" + "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.create", "description": "A new team is created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.demote_maintainer", "description": "A user was demoted from a team maintainer to a team member.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.destroy", "description": "A team was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.clear", "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.disable", "description": "Team discussions were disabled for an organization.", - "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization" + "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.enable", "description": "Team discussions were enabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.promote_maintainer", "description": "A user was promoted from a team member to a team maintainer.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_member", "description": "An organization member was removed from a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.rename", "description": "A team's name was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.disabled", "description": "Team synchronization with a tenant was disabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.enabled", "description": "Team synchronization with a tenant was enabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.update_okta_credentials", "description": "The Okta credentials for team synchronization with a tenant were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.cancel_workflow_run", "description": "A workflow run was cancelled.", - "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow" + "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.completed_workflow_run", "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history" + "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.created_workflow_run", "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow" + "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.prepared_workflow_job", "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows" + "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.rerun_workflow_run", "description": "A workflow run was re-run.", - "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs" + "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.10/user.json b/src/audit-logs/data/ghes-3.10/user.json index 1225f62c0eb7..965f5791df53 100644 --- a/src/audit-logs/data/ghes-3.10/user.json +++ b/src/audit-logs/data/ghes-3.10/user.json @@ -2,1786 +2,64967 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.confirm", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.recover", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.update_bill_cycle_day", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_fork_pr_approvals_policy", "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.create", "description": "An SSH key was added to a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.delete", "description": "An SSH key was removed from a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.publish", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.retire", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.create", "description": "An OAuth access token was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.destroy", "description": "An OAuth access token was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.regenerate", "description": "An OAuth access token was regenerated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.update", "description": "An OAuth access token was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.create", "description": "An authorization for an OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.destroy", "description": "An authorization for an OAuth application was deleted.", - "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations" + "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.register", "description": "A new passkey was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.remove", "description": "A new passkey was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.create", "description": "Triggered when you create a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_regenerated", "description": "Triggered when you regenerate a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_revoked", "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", - "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users" + "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.destroy", "description": "Triggered when you delete a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.update", "description": "A fine-grained personal access token was updated.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.temporary_access_granted", "description": "Temporary access was enabled for a repository.", - "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.register", "description": "A security key was registered for an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.remove", "description": "A security key was removed from an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_update_newsletter_send", "description": "Triggered when you send an email update to your sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.waitlist_join", "description": "You join the waitlist to join GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.accept", "description": "Triggered when you accept a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.cancel", "description": "Triggered when you cancel a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.create", "description": "Triggered when you create a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.decline", "description": "Triggered when you decline a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.revoke", "description": "Triggered when you revoke a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.register", "description": "A new trusted device was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.remove", "description": "A trusted device was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.abort", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.complete", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.ignore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_approve", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_decline", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.start", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.two_factor_destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.add_factor", "description": "A secondary authentication factor was added to a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.disabled", "description": "Two-factor authentication was disabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.enabled", "description": "Two-factor authentication was enabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.password_reset_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.recovery_codes_regenerated", "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.remove_factor", "description": "A secondary authentication factor was removed from a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.sign_in_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.update_fallback", "description": "The two-factor authentication fallback for a user account was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.add_email", "description": "An email address was added to a user account.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.async_delete", "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.audit_log_export", "description": "Audit log entries were exported.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.block_user", "description": "A user was blocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.change_password", "description": "A user changed their password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_granted", "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_revoked", "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create", "description": "A new user account was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create_integration_secret", "description": "A user secret for Codespaces was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.creation_rate_limit_exceeded", "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.delete", "description": "A user account was destroyed by an asynchronous job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.demote", "description": "A site administrator was demoted to an ordinary user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.destroy", "description": "A user deleted his or her account, triggering user.async_delete.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_failure", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_requested", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_success", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.failed_login", "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.forgot_password", "description": "A user requested a password reset.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.grant_github_developer", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.hide_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.login", "description": "A user signed in.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.logout", "description": "A user signed out.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.new_device_used", "description": "A user signed in from a new device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.promote", "description": "An ordinary user account was promoted to a site administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.recreate", "description": "A user's account was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_email", "description": "An email address was removed from a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_integration_secret", "description": "A user secret for Codespaces was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.rename", "description": "A username was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.reset_password", "description": "A user reset their account password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_session.country_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.show_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device", "description": "A user signed in from an unrecognized device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device_and_location", "description": "A user signed in from an unrecognized device and location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.destroy", "description": "Triggered when you clear the status on your profile.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.update", "description": "Triggered when you set or change the status on your profile.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.suspend", "description": "A user account was suspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.toggle_warn_private_email", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_failure", "description": "A 2FA challenge issued for a user account failed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_success", "description": "A 2FA challenge issued for a user account succeeded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recover", "description": "A user used their 2FA recovery codes.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_downloaded", "description": "A user downloaded 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_printed", "description": "A user printed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_viewed", "description": "A user viewed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_requested", "description": "A user was prompted for a two-factor authentication code.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unblock_user", "description": "A user was unblocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unsuspend", "description": "A user account was unsuspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_integration_secret", "description": "A user secret for Codespaces was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_new_repository_default_branch_setting", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.11/enterprise.json b/src/audit-logs/data/ghes-3.11/enterprise.json index 62d3366f3531..3df982a32b91 100644 --- a/src/audit-logs/data/ghes-3.11/enterprise.json +++ b/src/audit-logs/data/ghes-3.11/enterprise.json @@ -2,3296 +2,120143 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.confirm", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.recover", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "api.request", "description": "An API request was made to a security-significant endpoint for the enterprise. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "query_string", + "rate_limit_remaining", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_body", + "request_cancelled", + "request_method", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "route", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "status_code", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url_path", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.update_bill_cycle_day", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.add_admin", "description": "An enterprise owner was added to an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.add_organization", "description": "An organization was added to an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.disabled", "description": "GitHub Advanced Security was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.enabled", "description": "GitHub Advanced Security was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.advanced_security_policy_update", "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.advanced_security_repo_admin_enablement_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_actions_settings", "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_default_repository_permission", "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_members_can_create_repos", "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.create", "description": "An enterprise was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for new repositories in your enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for new repositories in your enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.dependabot_alerts_repo_admin_enablement_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.disable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the enterprise was disabled.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.disable_two_factor_requirement", "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.enable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the enterprise was enabled.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.enable_two_factor_requirement", "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.clear", "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.remove_admin", "description": "An enterprise owner was removed from an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.remove_organization", "description": "An organization was removed from an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.rename_slug", "description": "The slug for the enterprise URL was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the business level", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the business level", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.create", "description": "An enterprise-level custom pattern was created for secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.delete", "description": "An enterprise-level custom pattern was removed from secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.publish", "description": "An enterprise-level custom pattern was published for secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.update", "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.disable", "description": "Secret scanning was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.disabled_for_new_repos", "description": "Secret scanning was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.enable", "description": "Secret scanning was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.enabled_for_new_repos", "description": "Secret scanning was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.disable", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.enable", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.update", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.disable", "description": "Push protection for secret scanning was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.disabled_for_new_repos", "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.enable", "description": "Push protection for secret scanning was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.enabled_for_new_repos", "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.secret_scanning_repo_admin_settings_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_fork_pr_approvals_policy", "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_actions_settings", "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_default_repository_permission", "description": "The base repository permission setting was updated for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_member_repository_creation_permission", "description": "The repository creation setting was updated for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_member_repository_invitation_permission", "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_added", "description": "A seat was added to the Copilot Business subscription for a user and they have received access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_created", "description": "A seat assignment was newly created for a user.", - "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business" + "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_refreshed", "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_reused", "description": "A seat assignment was re-created for a user who already had a seat with no pending cancellation date.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_unassigned", "description": "A seat was unassigned from a user and they will lose access to GitHub Copilot at the end of the billing cycle.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled", "description": "A seat was canceled from the Copilot Business subscription and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled_by_staff", "description": "A seat was canceled from the Copilot Business subscription manually by GitHub and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.destroy", "description": "Triggered when a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.destroy", "description": "Triggered when a reply to a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.update", "description": "Triggered when a reply to a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.update", "description": "Triggered when a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.create", "description": "A global announcement banner was created for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.destroy", "description": "A global announcement banner was removed from the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.update", "description": "A global announcement banner was updated for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.approve", "description": "A domain was approved for an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.create", "description": "A domain was added to an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.destroy", "description": "A domain was removed from an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.verify", "description": "A domain was verified for an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.register_self_hosted_runner", "description": "A new GitHub Actions self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.remove_self_hosted_runner", "description": "A GitHub Actions self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_created", "description": "A GitHub Actions self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_removed", "description": "A GitHub Actions self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runner_removed", "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runners_added", "description": "A GitHub Actions self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runners_updated", "description": "A GitHub Actions runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_updated", "description": "The configuration of a GitHub Actions self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_offline", "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_online", "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_updated", "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git.clone", "description": "A repository was cloned.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.fetch", "description": "Changes were fetched from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.push", "description": "Changes were pushed to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git_signing_ssh_public_key.create", "description": "An SSH key was added to a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.delete", "description": "An SSH key was removed from a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable", "description": "An IP allow list was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_for_installed_apps", "description": "An IP allow list was disabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_user_level_enforcement", "description": "IP allow list user level enforcement was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable", "description": "An IP allow list was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_for_installed_apps", "description": "An IP allow list was enabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_user_level_enforcement", "description": "IP allow list user level enforcement was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.create", "description": "An IP address was added to an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.destroy", "description": "An IP address was deleted from an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.update", "description": "An IP address or its description was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.publish", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.retire", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.create", "description": "An OAuth access token was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.destroy", "description": "An OAuth access token was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.regenerate", "description": "An OAuth access token was regenerated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.update", "description": "An OAuth access token was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.suspend", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.unsuspend", "description": "An OAuth application was unsuspended for a user or organization account.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.create", "description": "An authorization for an OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.destroy", "description": "An authorization for an OAuth application was deleted.", - "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations" + "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.update", "description": "An authorization for an OAuth application was updated.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.accept_business_invitation", "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_billing_manager", "description": "A billing manager was added to an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_disabled", "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_enabled", "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.async_delete", "description": "A user initiated a background job to delete an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.audit_log_export", "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.billing_signup_error", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.block_user", "description": "An organization owner blocked a user from accessing the organization's repositories.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_business_invitation", "description": "An invitation for an organization to join an enterprise was revoked", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_invitation", "description": "An invitation sent to a user to join an organization was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.clear_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_enabled", "description": "Code scanning using the default setup was enabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.confirm_business_invitation", "description": "An invitation for an organization to join an enterprise was confirmed.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create", "description": "An organization was created.", - "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" + "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.delete", "description": "An organization was deleted by a user-initiated background job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_member_team_creation_permission", "description": "Team creation was limited to owners.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_reader_discussion_creation_permission", "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_saml", "description": "SAML single sign-on was disabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_two_factor_requirement", "description": "A two-factor authentication requirement was disabled for the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_disabled", "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_enabled", "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_member_team_creation_permission", "description": "Team creation by members was allowed.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_reader_discussion_creation_permission", "description": "An organization owner allowed users with read access to create discussions in an organization", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_saml", "description": "SAML single sign-on was enabled for the organization.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_two_factor_requirement", "description": "Two-factor authentication is now required for the organization.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_added", "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_removed", "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_member", "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_to_business", "description": "An organization was invited to join an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rate_limited_invites", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recreate", "description": "An organization was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_billing_manager", "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_outside_collaborator", "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rename", "description": "An organization was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.restore_member", "description": "An organization member was restored.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_created", "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_removed", "description": "A self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runner_removed", "description": "The REST API was used to remove a self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_added", "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_updated", "description": "A runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_updated", "description": "The configuration of a self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_disabled", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_enabled", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_updated", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_disable", "description": "Push protection for secret scanning was disabled.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_enable", "description": "Push protection for secret scanning was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_disable", "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_enable", "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transform", "description": "A user account was converted into an organization.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.unblock_user", "description": "A user was unblocked from an organization.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_settings", "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_default_repository_permission", "description": "The default repository permission level for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_saml_provider_settings", "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_terms_of_service", "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", - "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" + "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.approve", "description": "A domain was approved for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.create", "description": "A domain was added to an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.destroy", "description": "A domain was removed from an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.verify", "description": "A domain was verified for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_deleted", "description": "An entire package was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_published", "description": "A package was published or republished to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_deleted", "description": "A specific package version was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_published", "description": "A specific package version was published or republished to a package.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.register", "description": "A new passkey was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.remove", "description": "A new passkey was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.create", "description": "Triggered when you create a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_regenerated", "description": "Triggered when you regenerate a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_revoked", "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", - "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users" + "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.destroy", "description": "Triggered when you delete a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.update", "description": "A fine-grained personal access token was updated.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.authorized_users_teams", "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.branch_allowances", "description": "A protected branch allowance was given to a specific user, team or integration.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.create", "description": "Branch protection was enabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.destroy", "description": "Branch protection was disabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismiss_stale_reviews", "description": "Enforcement of dismissing stale pull requests was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismissal_restricted_users_teams", "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "authorized_actors", + "authorized_actors_only", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.policy_override", "description": "A branch protection requirement was overridden by a repository administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "after", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "before", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "compliant_pull_request_ids", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "overridden_codes", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reasons", + "referrer", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.rejected_ref_update", "description": "A branch update attempt was rejected.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_admin_enforced", "description": "Branch protection was enforced for repository administrators.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_deletions_enforcement_level", "description": "Branch deletion was enabled or disabled for a protected branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_force_pushes_enforcement_level", "description": "Force pushes were enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_ignore_approvals_from_contributors", "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_linear_history_requirement_enforcement_level", "description": "Required linear commit history was enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_allows_fetch_and_merge", "description": "Fork syncing was enabled or disabled for a read-only branch", - "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_branch_enforcement_level", "description": "The enforcement of a branch lock was updated.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_name", "description": "A branch name pattern was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_pull_request_reviews_enforcement_level", "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_code_owner_review", "description": "Enforcement of required code owner review was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_last_push_approval", "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_approving_review_count", "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_status_checks_enforcement_level", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_signature_requirement_enforcement_level", "description": "Enforcement of required commit signing was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_strict_required_status_checks_policy", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.close", "description": "A pull request was closed without being merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.converted_to_draft", "description": "A pull request was converted to a draft.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create", "description": "A pull request was created.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create_review_request", "description": "A review was requested on a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.in_progress", "description": "A pull request was marked as in progress.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.indirect_merge", "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.merge", "description": "A pull request was merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.ready_for_review", "description": "A pull request was marked as ready for review.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.rebase", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.remove_review_request", "description": "A review request was removed from a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.reopen", "description": "A pull request was reopened after previously being closed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.create", "description": "A review comment was added to a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.delete", "description": "A review comment on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.update", "description": "A review comment on a pull request was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.delete", "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.dismiss", "description": "A review on a pull request was dismissed.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.submit", "description": "A review on a pull request was submitted.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_disabled", "description": "Code scanning using the default setup was disabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_enabled", "description": "Code scanning using the default setup was enabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.disk_archive", "description": "A repository was archived on disk.", - "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories" + "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.download_zip", "description": "A source code archive of a repository was downloaded as a ZIP file.", - "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives" + "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.hide_from_discovery", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.noindex", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.override_unlock", "description": "The repository was unlocked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_build", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.require_login", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.temporary_access_granted", "description": "Temporary access was enabled for a repository.", - "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repo_was", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_branch_protection_evaluation.disable", "description": "Branch protections were disabled for the repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_branch_protection_evaluation.enable", "description": "Branch protections were enabled for this repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.disable", "description": "Secret scanning was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.enable", "description": "Secret scanning was enabled for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.disable", "description": "Secret scanning push protection was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.enable", "description": "Secret scanning push protection was enabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.disable", "description": "Email notification restrictions for an organization or enterprise were disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.enable", "description": "Email notification restrictions for an organization or enterprise were enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.create", "description": "GitHub detected a secret and created a secret scanning alert.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.reopen", "description": "A seret scanning alert was reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.resolve", "description": "A seret scanning alert was resolved.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.revoke", "description": "A secret scanning alert was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.disable", "description": "Secret scanning was disabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.enable", "description": "Secret scanning was enabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.disable", "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.enable", "description": "Secret scanning was enabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_push_protection.bypass", "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.register", "description": "A security key was registered for an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.remove", "description": "A security key was removed from an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_update_newsletter_send", "description": "Triggered when you send an email update to your sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.waitlist_join", "description": "You join the waitlist to join GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.create", "description": "An SSH certificate authority for an organization or enterprise was created.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.destroy", "description": "An SSH certificate authority for an organization or enterprise was deleted.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.disable", "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.enable", "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.set_domain_token_expiration", "description": "The verification code expiry time for an organization or enterprise domain was set.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.unverify_domain", "description": "An organization or enterprise domain was unverified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.verify_domain", "description": "An organization or enterprise domain was verified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.accept", "description": "Triggered when you accept a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.cancel", "description": "Triggered when you cancel a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.create", "description": "Triggered when you create a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.decline", "description": "Triggered when you decline a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.revoke", "description": "Triggered when you revoke a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_member", "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_repository", "description": "A team was given access and permissions to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_parent_team", "description": "A child team was created or a child team's parent was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" + "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_privacy", "description": "A team's privacy level was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility" + "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.create", "description": "A new team is created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.demote_maintainer", "description": "A user was demoted from a team maintainer to a team member.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.destroy", "description": "A team was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.clear", "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.disable", "description": "Team discussions were disabled for an organization.", - "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization" + "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.enable", "description": "Team discussions were enabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.promote_maintainer", "description": "A user was promoted from a team member to a team maintainer.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_member", "description": "An organization member was removed from a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.rename", "description": "A team's name was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.disabled", "description": "Team synchronization with a tenant was disabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.enabled", "description": "Team synchronization with a tenant was enabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.register", "description": "A new trusted device was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.remove", "description": "A trusted device was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.abort", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.complete", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.ignore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_approve", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_decline", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.start", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.two_factor_destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.add_factor", "description": "A secondary authentication factor was added to a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.disabled", "description": "Two-factor authentication was disabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.enabled", "description": "Two-factor authentication was enabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.password_reset_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.recovery_codes_regenerated", "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.remove_factor", "description": "A secondary authentication factor was removed from a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.sign_in_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.update_fallback", "description": "The two-factor authentication fallback for a user account was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.add_email", "description": "An email address was added to a user account.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.async_delete", "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.audit_log_export", "description": "Audit log entries were exported.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.block_user", "description": "A user was blocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.change_password", "description": "A user changed their password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_granted", "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_revoked", "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_device", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_device_and_location", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_location", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create", "description": "A new user account was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create_integration_secret", "description": "A user secret for Codespaces was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.creation_rate_limit_exceeded", "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.delete", "description": "A user account was destroyed by an asynchronous job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.demote", "description": "A site administrator was demoted to an ordinary user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.destroy", "description": "A user deleted his or her account, triggering user.async_delete.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_failure", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_requested", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_success", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.failed_login", "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.flag_as_large_scale_contributor", "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.forgot_password", "description": "A user requested a password reset.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.grant_github_developer", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.hide_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.login", "description": "A user signed in.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.logout", "description": "A user signed out.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.minimize_comment", "description": "A comment made by a user was minimized.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.new_device_used", "description": "A user signed in from a new device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.partial_two_factor_email_followup", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.promote", "description": "An ordinary user account was promoted to a site administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.recreate", "description": "A user's account was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_email", "description": "An email address was removed from a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_integration_secret", "description": "A user secret for Codespaces was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_large_scale_contributor_flag", "description": "A user account was no longer flagged as a large scale contributor.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.rename", "description": "A username was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.report_abuse", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.report_content", "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.reset_password", "description": "A user reset their account password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_session.country_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.show_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device", "description": "A user signed in from an unrecognized device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device_and_location", "description": "A user signed in from an unrecognized device and location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_location", "description": "A user signed in from an unrecognized location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.destroy", "description": "Triggered when you clear the status on your profile.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.update", "description": "Triggered when you set or change the status on your profile.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.suspend", "description": "A user account was suspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.toggle_warn_private_email", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_failure", "description": "A 2FA challenge issued for a user account failed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_success", "description": "A 2FA challenge issued for a user account succeeded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recover", "description": "A user used their 2FA recovery codes.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_downloaded", "description": "A user downloaded 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_printed", "description": "A user printed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_viewed", "description": "A user viewed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_requested", "description": "A user was prompted for a two-factor authentication code.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unblock_user", "description": "A user was unblocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unminimize_comment", "description": "A comment made by a user was unminimized.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unsuspend", "description": "A user account was unsuspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_integration_secret", "description": "A user secret for Codespaces was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_new_repository_default_branch_setting", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.cancel_workflow_run", "description": "A workflow run was cancelled.", - "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow" + "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.completed_workflow_run", "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history" + "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.created_workflow_run", "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow" + "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.prepared_workflow_job", "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows" + "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.rerun_workflow_run", "description": "A workflow run was re-run.", - "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs" + "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.11/organization.json b/src/audit-logs/data/ghes-3.11/organization.json index ccb9b747d4bc..5176daad66ca 100644 --- a/src/audit-logs/data/ghes-3.11/organization.json +++ b/src/audit-logs/data/ghes-3.11/organization.json @@ -2,3066 +2,111729 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.accept", "description": "Credit was accepted for a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.create", "description": "Someone was added to the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.decline", "description": "Credit was declined for a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.destroy", "description": "Someone was removed from the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "auto_approve_personal_access_token_requests.disable", "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "auto_approve_personal_access_token_requests.enable", "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.attempted_to_create_from_prebuild", "description": "An attempt to create a codespace from a prebuild was made.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.business_enablement_updated", "description": "Enterprise setting for Codespaces ownership was updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_created", "description": "Policies were applied to codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_deleted", "description": "Policies were removed from codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_updated", "description": "Policies were updated for codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "commit_comment.destroy", "description": "A commit comment was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "commit_comment.update", "description": "A commit comment was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_org_settings_changed", "description": "Settings for Copilot Business were changed at the organization level.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_added", "description": "A seat was added to the Copilot Business subscription for a user and they have received access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_created", "description": "A seat assignment was newly created for a user.", - "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business" + "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_refreshed", "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_reused", "description": "A seat assignment was re-created for a user who already had a seat with no pending cancellation date.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_unassigned", "description": "A seat was unassigned from a user and they will lose access to GitHub Copilot at the end of the billing cycle.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled", "description": "A seat was canceled from the Copilot Business subscription and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled_by_staff", "description": "A seat was canceled from the Copilot Business subscription manually by GitHub and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_management_changed", "description": "The seat management setting was changed for the Copilot Business subscription.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_comment.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_comment.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.destroy", "description": "Triggered when a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.destroy", "description": "Triggered when a reply to a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.update", "description": "Triggered when a reply to a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.update", "description": "Triggered when a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_installation.create", "description": "The GitHub App associated with a GitHub Connect connection was created.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_installation.destroy", "description": "The GitHub App associated with a GitHub Connect connection was deleted.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git.clone", "description": "A repository was cloned.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.fetch", "description": "Changes were fetched from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.push", "description": "Changes were pushed to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation_request.close", "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reason", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation_request.create", "description": "A member requested that an owner install a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable", "description": "An IP allow list was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_for_installed_apps", "description": "An IP allow list was disabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable", "description": "An IP allow list was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_for_installed_apps", "description": "An IP allow list was enabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.create", "description": "An IP address was added to an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.destroy", "description": "An IP address was deleted from an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.update", "description": "An IP address or its description was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue_comment.destroy", "description": "A comment on an issue was deleted from the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.destroy", "description": "An issue was deleted from the repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue" + "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.pinned", "description": "An issue was pinned to a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.transfer", "description": "An issue was transferred to another repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.unpinned", "description": "An issue was unpinned from a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_disabled", "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_enabled", "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_policy_cleared", "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_pages.disable", "description": "The ability for members to publish GitHub Pages sites was disabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_pages.enable", "description": "The ability for members to publish GitHub Pages sites was enabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_private_pages.disable", "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_private_pages.enable", "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_public_pages.disable", "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_public_pages.enable", "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.clear", "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.disable", "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.enable", "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.clear", "description": "An enterprise owner cleared the policy setting for viewing dependency insights in any organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.disable", "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.enable", "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.destroy_file", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.download", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.accept_business_invitation", "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_billing_manager", "description": "A billing manager was added to an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_disabled", "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_enabled", "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.allow_third_party_access_requests_from_outside_collaborators_disabled", "description": "Third-party application access for outside collaborators was disabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled", "description": "Third-party application access for outside collaborators was enabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.archive", "description": "The organization was archived.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.audit_log_export", "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.audit_log_git_event_export", "description": "An export of the organization's Git events was created.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.billing_signup_error", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.block_user", "description": "An organization owner blocked a user from accessing the organization's repositories.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_business_invitation", "description": "An invitation for an organization to join an enterprise was revoked", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_invitation", "description": "An invitation sent to a user to join an organization was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.clear_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_enabled", "description": "Code scanning using the default setup was enabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_access_updated", "description": "Access to use Codespaces on internal and private repositories was updated for an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_ownership_updated", "description": "Ownership and payment for codespaces was updated for an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_team_access_allowed", "description": "A team has been allowed to use Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_team_access_revoked", "description": "A team has been prevented from using Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_user_access_allowed", "description": "A user has been allowed to use Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_user_access_revoked", "description": "A user has been prevented from using Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.confirm_business_invitation", "description": "An invitation for an organization to join an enterprise was confirmed.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.connect_usage_metrics_export", "description": "Server statistics were exported for the organization.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create", "description": "An organization was created.", - "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" + "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_actions_secret", "description": "A GitHub Actions secret was created for an organization.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_integration_secret", "description": "An integration secret was created for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.deauthorize", "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.grant", "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.revoke", "description": "An owner revoked authorized credentials.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_member_team_creation_permission", "description": "Team creation was limited to owners.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were disabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_reader_discussion_creation_permission", "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_saml", "description": "SAML single sign-on was disabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the organization was disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_two_factor_requirement", "description": "A two-factor authentication requirement was disabled for the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_disabled", "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_enabled", "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_member_team_creation_permission", "description": "Team creation by members was allowed.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were enabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_reader_discussion_creation_permission", "description": "An organization owner allowed users with read access to create discussions in an organization", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_saml", "description": "SAML single sign-on was enabled for the organization.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the organization was enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_two_factor_requirement", "description": "Two-factor authentication is now required for the organization.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_added", "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_removed", "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_member", "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_to_business", "description": "An organization was invited to join an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_approved", "description": "Access to an organization was granted for an OAuth App.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_blocked", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_denied", "description": "Access was disabled for an OAuth App that was previously approved.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_requested", "description": "An organization member requested that an owner grant an OAuth App access to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_unblocked", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rate_limited_invites", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_actions_secret", "description": "A GitHub Actions secret was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_billing_manager", "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_integration_secret", "description": "An integration secret was removed from an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_outside_collaborator", "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rename", "description": "An organization was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_create", "description": "Triggered when a required workflow is created.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_delete", "description": "Triggered when a required workflow is deleted.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_update", "description": "Triggered when a required workflow is updated.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.restore_member", "description": "An organization member was restored.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.revoke_external_identity", "description": "A member's linked identity was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.revoke_sso_session", "description": "A member's SAML session was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_created", "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_removed", "description": "A self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_renamed", "description": "A self-hosted runner group was renamed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runner_removed", "description": "The REST API was used to remove a self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_added", "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_updated", "description": "A runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_updated", "description": "The configuration of a self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_visiblity_updated", "description": "The visibility of a self-hosted runner group was updated via the REST API.", - "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_generic_secrets.disabled", "description": "Generic secrets have been disabled at the organization level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_generic_secrets.enabled", "description": "Generic secrets have been enabled at the organization level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_disabled", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_enabled", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_updated", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_disable", "description": "Push protection for secret scanning was disabled.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_enable", "description": "Push protection for secret scanning was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_disable", "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_enable", "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transfer", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transfer_outgoing", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.unarchive", "description": "The organization was unarchived.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.unblock_user", "description": "A user was unblocked from an organization.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_settings", "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_default_repository_permission", "description": "The default repository permission level for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_integration_secret", "description": "An integration secret was updated for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_new_repository_default_branch_setting", "description": "The name of the default branch was changed for new repositories in the organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_repo_self_hosted_runners_policy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_emu_repo_runners_policy", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_repo_runners_policy", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_emu_repo_runners_policy", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_repo_runners_policy", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_saml_provider_settings", "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_terms_of_service", "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", - "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" + "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.create", "description": "A default label was created for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.destroy", "description": "A default label was deleted for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.update", "description": "A default label was edited for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.approve", "description": "A domain was approved for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.create", "description": "A domain was added to an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.destroy", "description": "A domain was removed from an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.verify", "description": "A domain was verified for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.add_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.add_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.remove_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.remove_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.clear", "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.disable", "description": "Organization projects were disabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.enable", "description": "Organization projects were enabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_role.create", "description": "A custom organization role was created in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_role.destroy", "description": "A custom organization role was deleted in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_role.update", "description": "A custom organization role was edited in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_deleted", "description": "An entire package was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_published", "description": "A package was published or republished to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_deleted", "description": "A specific package version was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_published", "description": "A specific package version was published or republished to a package.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.create", "description": "A GitHub Codespaces prebuild configuration for a repository was created.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.destroy", "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.run_triggered", "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.update", "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.clear", "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.disable", "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.enable", "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.authorized_users_teams", "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.branch_allowances", "description": "A protected branch allowance was given to a specific user, team or integration.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.create", "description": "Branch protection was enabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.destroy", "description": "Branch protection was disabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismiss_stale_reviews", "description": "Enforcement of dismissing stale pull requests was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismissal_restricted_users_teams", "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "authorized_actors", + "authorized_actors_only", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.policy_override", "description": "A branch protection requirement was overridden by a repository administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "after", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "before", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "compliant_pull_request_ids", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "overridden_codes", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reasons", + "referrer", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.rejected_ref_update", "description": "A branch update attempt was rejected.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_admin_enforced", "description": "Branch protection was enforced for repository administrators.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_deletions_enforcement_level", "description": "Branch deletion was enabled or disabled for a protected branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_force_pushes_enforcement_level", "description": "Force pushes were enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_ignore_approvals_from_contributors", "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_linear_history_requirement_enforcement_level", "description": "Required linear commit history was enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_allows_fetch_and_merge", "description": "Fork syncing was enabled or disabled for a read-only branch", - "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_branch_enforcement_level", "description": "The enforcement of a branch lock was updated.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_name", "description": "A branch name pattern was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_pull_request_reviews_enforcement_level", "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_code_owner_review", "description": "Enforcement of required code owner review was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_last_push_approval", "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_approving_review_count", "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_status_checks_enforcement_level", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_signature_requirement_enforcement_level", "description": "Enforcement of required commit signing was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_strict_required_status_checks_policy", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.close", "description": "A pull request was closed without being merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.converted_to_draft", "description": "A pull request was converted to a draft.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create", "description": "A pull request was created.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create_review_request", "description": "A review was requested on a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.in_progress", "description": "A pull request was marked as in progress.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.indirect_merge", "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.merge", "description": "A pull request was merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.ready_for_review", "description": "A pull request was marked as ready for review.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.rebase", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.remove_review_request", "description": "A review request was removed from a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.reopen", "description": "A pull request was reopened after previously being closed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.create", "description": "A review comment was added to a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.delete", "description": "A review comment on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.update", "description": "A review comment on a pull request was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.delete", "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.dismiss", "description": "A review on a pull request was dismissed.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.submit", "description": "A review on a pull request was submitted.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_disabled", "description": "Code scanning using the default setup was disabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_enabled", "description": "Code scanning using the default setup was enabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to this repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to this repository was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.download_zip", "description": "A source code archive of a repository was downloaded as a ZIP file.", - "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives" + "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename_branch", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repo_was", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.close", "description": "Someone closed a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.cve_request", "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.github_broadcast", "description": "GitHub made a security advisory public in the GitHub Advisory Database.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.github_withdraw", "description": "GitHub withdrew a security advisory that was published in error.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.open", "description": "Someone opened a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.publish", "description": "Someone published a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.reopen", "description": "Someone reopened as draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.update", "description": "Someone edited a draft or published security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_branch_protection_evaluation.disable", "description": "Branch protections were disabled for the repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_branch_protection_evaluation.enable", "description": "Branch protections were enabled for this repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_content_analysis.disable", "description": "Data use settings were disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_content_analysis.enable", "description": "Data use settings were enabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_dependency_graph.disable", "description": "The dependency graph was disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_dependency_graph.enable", "description": "The dependency graph was enabled for a private repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.clear", "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.disable", "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.enable", "description": "Repository projects were enabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.disable", "description": "Secret scanning was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.enable", "description": "Secret scanning was enabled for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_generic_secrets.disabled", "description": "Generic secrets have been disabled at the repository level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_generic_secrets.enabled", "description": "Generic secrets have been enabled at the repository level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.disable", "description": "Secret scanning push protection was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.enable", "description": "Secret scanning push protection was enabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.clear", "description": "The repository visibility change setting was cleared for an organization or enterprise.", - "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility" + "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.disable", "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.enable", "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.auto_dismiss", "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.auto_reopen", "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.create", "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.dismiss", "description": "A Dependabot alert was manually dismissed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.reintroduce", "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.reopen", "description": "A Dependabot alert was manually reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.resolve", "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.authorized_users_teams", "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts_auto_dismissal.disable", "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts_auto_dismissal.enable", "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.disable", "description": "Dependabot alerts was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.enable", "description": "Dependabot alerts was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "required_status_check.create", "description": "A status check was marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "context", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "required_status_check.destroy", "description": "A status check was no longer marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "context", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.disable", "description": "Email notification restrictions for an organization or enterprise were disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.enable", "description": "Email notification restrictions for an organization or enterprise were enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.create", "description": "A new custom repository role was created.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.destroy", "description": "A custom repository role was deleted.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.update", "description": "A custom repository role was edited.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.create", "description": "GitHub detected a secret and created a secret scanning alert.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.reopen", "description": "A seret scanning alert was reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.resolve", "description": "A seret scanning alert was resolved.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.revoke", "description": "A secret scanning alert was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.disable", "description": "Secret scanning was disabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.enable", "description": "Secret scanning was enabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.disable", "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.enable", "description": "Secret scanning was enabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_push_protection.bypass", "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.invoiced_agreement_sign", "description": "An agreement for invoiced billing for GitHub Sponsors was signed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.create", "description": "An SSH certificate authority for an organization or enterprise was created.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.destroy", "description": "An SSH certificate authority for an organization or enterprise was deleted.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.disable", "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.enable", "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.dependabot_debug_credentials_generated", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.set_domain_token_expiration", "description": "The verification code expiry time for an organization or enterprise domain was set.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.unverify_domain", "description": "An organization or enterprise domain was unverified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.verify_domain", "description": "An organization or enterprise domain was verified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_member", "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_repository", "description": "A team was given access and permissions to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_parent_team", "description": "A child team was created or a child team's parent was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" + "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_privacy", "description": "A team's privacy level was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility" + "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.create", "description": "A new team is created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.demote_maintainer", "description": "A user was demoted from a team maintainer to a team member.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.destroy", "description": "A team was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.clear", "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.disable", "description": "Team discussions were disabled for an organization.", - "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization" + "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.enable", "description": "Team discussions were enabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.promote_maintainer", "description": "A user was promoted from a team member to a team maintainer.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_member", "description": "An organization member was removed from a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.rename", "description": "A team's name was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.disabled", "description": "Team synchronization with a tenant was disabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.enabled", "description": "Team synchronization with a tenant was enabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.update_okta_credentials", "description": "The Okta credentials for team synchronization with a tenant were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.create", "description": "A Dependabot rule was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.delete", "description": "A Dependabot rule was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.disable", "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.enable", "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.update", "description": "A Dependabot rule's conditions, actions, or metadata changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.cancel_workflow_run", "description": "A workflow run was cancelled.", - "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow" + "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.completed_workflow_run", "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history" + "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.created_workflow_run", "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow" + "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.prepared_workflow_job", "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows" + "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.rerun_workflow_run", "description": "A workflow run was re-run.", - "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs" + "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.11/user.json b/src/audit-logs/data/ghes-3.11/user.json index c72a36e453c2..985f0ac80052 100644 --- a/src/audit-logs/data/ghes-3.11/user.json +++ b/src/audit-logs/data/ghes-3.11/user.json @@ -2,1816 +2,66444 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.confirm", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.recover", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.update_bill_cycle_day", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_fork_pr_approvals_policy", "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_added", "description": "A seat was added to the Copilot Business subscription for a user and they have received access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_created", "description": "A seat assignment was newly created for a user.", - "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business" + "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_refreshed", "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_reused", "description": "A seat assignment was re-created for a user who already had a seat with no pending cancellation date.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_unassigned", "description": "A seat was unassigned from a user and they will lose access to GitHub Copilot at the end of the billing cycle.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled", "description": "A seat was canceled from the Copilot Business subscription and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled_by_staff", "description": "A seat was canceled from the Copilot Business subscription manually by GitHub and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.create", "description": "An SSH key was added to a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.delete", "description": "An SSH key was removed from a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.publish", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.retire", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.create", "description": "An OAuth access token was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.destroy", "description": "An OAuth access token was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.regenerate", "description": "An OAuth access token was regenerated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.update", "description": "An OAuth access token was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.create", "description": "An authorization for an OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.destroy", "description": "An authorization for an OAuth application was deleted.", - "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations" + "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.register", "description": "A new passkey was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.remove", "description": "A new passkey was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.create", "description": "Triggered when you create a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_regenerated", "description": "Triggered when you regenerate a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_revoked", "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", - "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users" + "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.destroy", "description": "Triggered when you delete a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.update", "description": "A fine-grained personal access token was updated.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.temporary_access_granted", "description": "Temporary access was enabled for a repository.", - "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repo_was", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.register", "description": "A security key was registered for an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.remove", "description": "A security key was removed from an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_update_newsletter_send", "description": "Triggered when you send an email update to your sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.waitlist_join", "description": "You join the waitlist to join GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.accept", "description": "Triggered when you accept a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.cancel", "description": "Triggered when you cancel a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.create", "description": "Triggered when you create a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.decline", "description": "Triggered when you decline a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.revoke", "description": "Triggered when you revoke a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.register", "description": "A new trusted device was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.remove", "description": "A trusted device was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.abort", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.complete", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.ignore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_approve", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_decline", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.start", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.two_factor_destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.add_factor", "description": "A secondary authentication factor was added to a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.disabled", "description": "Two-factor authentication was disabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.enabled", "description": "Two-factor authentication was enabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.password_reset_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.recovery_codes_regenerated", "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.remove_factor", "description": "A secondary authentication factor was removed from a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.sign_in_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.update_fallback", "description": "The two-factor authentication fallback for a user account was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.add_email", "description": "An email address was added to a user account.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.async_delete", "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.audit_log_export", "description": "Audit log entries were exported.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.block_user", "description": "A user was blocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.change_password", "description": "A user changed their password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_granted", "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_revoked", "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create", "description": "A new user account was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create_integration_secret", "description": "A user secret for Codespaces was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.creation_rate_limit_exceeded", "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.delete", "description": "A user account was destroyed by an asynchronous job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.demote", "description": "A site administrator was demoted to an ordinary user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.destroy", "description": "A user deleted his or her account, triggering user.async_delete.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_failure", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_requested", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_success", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.failed_login", "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.forgot_password", "description": "A user requested a password reset.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.grant_github_developer", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.hide_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.login", "description": "A user signed in.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.logout", "description": "A user signed out.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.new_device_used", "description": "A user signed in from a new device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.promote", "description": "An ordinary user account was promoted to a site administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.recreate", "description": "A user's account was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_email", "description": "An email address was removed from a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_integration_secret", "description": "A user secret for Codespaces was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.rename", "description": "A username was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.reset_password", "description": "A user reset their account password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_session.country_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.show_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device", "description": "A user signed in from an unrecognized device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device_and_location", "description": "A user signed in from an unrecognized device and location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.destroy", "description": "Triggered when you clear the status on your profile.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.update", "description": "Triggered when you set or change the status on your profile.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.suspend", "description": "A user account was suspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.toggle_warn_private_email", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_failure", "description": "A 2FA challenge issued for a user account failed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_success", "description": "A 2FA challenge issued for a user account succeeded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recover", "description": "A user used their 2FA recovery codes.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_downloaded", "description": "A user downloaded 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_printed", "description": "A user printed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_viewed", "description": "A user viewed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_requested", "description": "A user was prompted for a two-factor authentication code.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unblock_user", "description": "A user was unblocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unsuspend", "description": "A user account was unsuspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_integration_secret", "description": "A user secret for Codespaces was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_new_repository_default_branch_setting", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.12/enterprise.json b/src/audit-logs/data/ghes-3.12/enterprise.json index 0334bf803bd5..26ce8e3f6135 100644 --- a/src/audit-logs/data/ghes-3.12/enterprise.json +++ b/src/audit-logs/data/ghes-3.12/enterprise.json @@ -2,3346 +2,122003 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.confirm", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.recover", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "api.request", "description": "An API request was made to a security-significant endpoint for the enterprise. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "query_string", + "rate_limit_remaining", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_body", + "request_cancelled", + "request_method", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "route", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "status_code", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url_path", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.update_bill_cycle_day", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.add_admin", "description": "An enterprise owner was added to an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.add_organization", "description": "An organization was added to an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.disabled", "description": "GitHub Advanced Security was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.enabled", "description": "GitHub Advanced Security was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.advanced_security_policy_update", "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.advanced_security_repo_admin_enablement_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_actions_settings", "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_default_repository_permission", "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_members_can_create_repos", "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.create", "description": "An enterprise was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for new repositories in your enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for new repositories in your enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.dependabot_alerts_repo_admin_enablement_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.disable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the enterprise was disabled.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.disable_two_factor_requirement", "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.enable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the enterprise was enabled.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.enable_two_factor_requirement", "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.clear", "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.remove_admin", "description": "An enterprise owner was removed from an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.remove_organization", "description": "An organization was removed from an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.rename_slug", "description": "The slug for the enterprise URL was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the business level", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the business level", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.create", "description": "An enterprise-level custom pattern was created for secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.delete", "description": "An enterprise-level custom pattern was removed from secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.publish", "description": "An enterprise-level custom pattern was published for secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.update", "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.disable", "description": "Secret scanning was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.disabled_for_new_repos", "description": "Secret scanning was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.enable", "description": "Secret scanning was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.enabled_for_new_repos", "description": "Secret scanning was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.disable", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.enable", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.update", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.disable", "description": "Push protection for secret scanning was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.disabled_for_new_repos", "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.enable", "description": "Push protection for secret scanning was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.enabled_for_new_repos", "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.secret_scanning_repo_admin_settings_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_fork_pr_approvals_policy", "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_actions_settings", "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_default_repository_permission", "description": "The base repository permission setting was updated for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_member_repository_creation_permission", "description": "The repository creation setting was updated for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_member_repository_invitation_permission", "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_added", "description": "A seat was added to the Copilot Business subscription for a user and they have received access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_created", "description": "A seat assignment was newly created for a user.", - "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business" + "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_refreshed", "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_reused", "description": "A seat assignment was re-created for a user who already had a seat with no pending cancellation date.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_unassigned", "description": "A seat was unassigned from a user and they will lose access to GitHub Copilot at the end of the billing cycle.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled", "description": "A seat was canceled from the Copilot Business subscription and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled_by_staff", "description": "A seat was canceled from the Copilot Business subscription manually by GitHub and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_definition.create", "description": "A new custom property definition was created.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "allowed_values", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "default_value", + "definition_id", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_allowed_values", + "old_base_role", + "old_default_value", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_required", + "old_role_permissions", + "old_user", + "old_value_type", + "old_values_editable_by", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value_type", + "values_editable_by", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_definition.destroy", "description": "A custom property definition was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "allowed_values", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "default_value", + "definition_id", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_allowed_values", + "old_base_role", + "old_default_value", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_required", + "old_role_permissions", + "old_user", + "old_value_type", + "old_values_editable_by", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value_type", + "values_editable_by", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_definition.update", "description": "A custom property definition was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "allowed_values", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "default_value", + "definition_id", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_allowed_values", + "old_base_role", + "old_default_value", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_required", + "old_role_permissions", + "old_user", + "old_value_type", + "old_values_editable_by", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value_type", + "values_editable_by", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_value.create", "description": "A repository's custom property value was manually set for the first time.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "definition_id", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_value.destroy", "description": "A repository's custom property value was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "definition_id", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_value.update", "description": "A repository's custom property value was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "definition_id", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.destroy", "description": "Triggered when a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.destroy", "description": "Triggered when a reply to a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.update", "description": "Triggered when a reply to a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.update", "description": "Triggered when a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.create", "description": "A global announcement banner was created for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.destroy", "description": "A global announcement banner was removed from the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.update", "description": "A global announcement banner was updated for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.approve", "description": "A domain was approved for an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.create", "description": "A domain was added to an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.destroy", "description": "A domain was removed from an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.verify", "description": "A domain was verified for an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.register_self_hosted_runner", "description": "A new GitHub Actions self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.remove_self_hosted_runner", "description": "A GitHub Actions self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_created", "description": "A GitHub Actions self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_removed", "description": "A GitHub Actions self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runner_removed", "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runners_added", "description": "A GitHub Actions self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runners_updated", "description": "A GitHub Actions runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_updated", "description": "The configuration of a GitHub Actions self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_offline", "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_online", "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_updated", "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git.clone", "description": "A repository was cloned.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.fetch", "description": "Changes were fetched from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.push", "description": "Changes were pushed to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git_signing_ssh_public_key.create", "description": "An SSH key was added to a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.delete", "description": "An SSH key was removed from a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable", "description": "An IP allow list was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_for_installed_apps", "description": "An IP allow list was disabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_user_level_enforcement", "description": "IP allow list user level enforcement was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable", "description": "An IP allow list was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_for_installed_apps", "description": "An IP allow list was enabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_user_level_enforcement", "description": "IP allow list user level enforcement was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.create", "description": "An IP address was added to an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.destroy", "description": "An IP address was deleted from an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.update", "description": "An IP address or its description was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.publish", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.retire", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.create", "description": "An OAuth access token was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.destroy", "description": "An OAuth access token was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.regenerate", "description": "An OAuth access token was regenerated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.update", "description": "An OAuth access token was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.suspend", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.unsuspend", "description": "An OAuth application was unsuspended for a user or organization account.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.create", "description": "An authorization for an OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.destroy", "description": "An authorization for an OAuth application was deleted.", - "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations" + "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.update", "description": "An authorization for an OAuth application was updated.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.accept_business_invitation", "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_billing_manager", "description": "A billing manager was added to an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_disabled", "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_enabled", "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.async_delete", "description": "A user initiated a background job to delete an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.audit_log_export", "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.billing_signup_error", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.block_user", "description": "An organization owner blocked a user from accessing the organization's repositories.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_business_invitation", "description": "An invitation for an organization to join an enterprise was revoked", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_invitation", "description": "An invitation sent to a user to join an organization was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.clear_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_enabled", "description": "Code scanning using the default setup was enabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.confirm_business_invitation", "description": "An invitation for an organization to join an enterprise was confirmed.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create", "description": "An organization was created.", - "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" + "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.delete", "description": "An organization was deleted by a user-initiated background job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_member_team_creation_permission", "description": "Team creation was limited to owners.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_reader_discussion_creation_permission", "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_saml", "description": "SAML single sign-on was disabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_two_factor_requirement", "description": "A two-factor authentication requirement was disabled for the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_disabled", "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_enabled", "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_member_team_creation_permission", "description": "Team creation by members was allowed.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_reader_discussion_creation_permission", "description": "An organization owner allowed users with read access to create discussions in an organization", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_saml", "description": "SAML single sign-on was enabled for the organization.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_two_factor_requirement", "description": "Two-factor authentication is now required for the organization.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_added", "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_removed", "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_member", "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_to_business", "description": "An organization was invited to join an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rate_limited_invites", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recreate", "description": "An organization was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_billing_manager", "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_outside_collaborator", "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rename", "description": "An organization was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.restore_member", "description": "An organization member was restored.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_created", "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_removed", "description": "A self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runner_removed", "description": "The REST API was used to remove a self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_added", "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_updated", "description": "A runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_updated", "description": "The configuration of a self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_disabled", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_enabled", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_updated", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_disable", "description": "Push protection for secret scanning was disabled.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_enable", "description": "Push protection for secret scanning was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_disable", "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_enable", "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transform", "description": "A user account was converted into an organization.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.unblock_user", "description": "A user was unblocked from an organization.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_settings", "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_default_repository_permission", "description": "The default repository permission level for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_saml_provider_settings", "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_terms_of_service", "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", - "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" + "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.approve", "description": "A domain was approved for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.create", "description": "A domain was added to an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.destroy", "description": "A domain was removed from an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.verify", "description": "A domain was verified for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_deleted", "description": "An entire package was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_published", "description": "A package was published or republished to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_deleted", "description": "A specific package version was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_published", "description": "A specific package version was published or republished to a package.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.register", "description": "A new passkey was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.remove", "description": "A new passkey was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.create", "description": "Triggered when you create a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_regenerated", "description": "Triggered when you regenerate a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_revoked", "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", - "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users" + "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.destroy", "description": "Triggered when you delete a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.update", "description": "A fine-grained personal access token was updated.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.authorized_users_teams", "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.branch_allowances", "description": "A protected branch allowance was given to a specific user, team or integration.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "authorized_actors", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.create", "description": "Branch protection was enabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.destroy", "description": "Branch protection was disabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismiss_stale_reviews", "description": "Enforcement of dismissing stale pull requests was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismissal_restricted_users_teams", "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "authorized_actors", + "authorized_actors_only", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.policy_override", "description": "A branch protection requirement was overridden by a repository administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "after", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "before", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "compliant_pull_request_ids", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "overridden_codes", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reasons", + "referrer", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.rejected_ref_update", "description": "A branch update attempt was rejected.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_admin_enforced", "description": "Branch protection was enforced for repository administrators.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_deletions_enforcement_level", "description": "Branch deletion was enabled or disabled for a protected branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_force_pushes_enforcement_level", "description": "Force pushes were enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_ignore_approvals_from_contributors", "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_linear_history_requirement_enforcement_level", "description": "Required linear commit history was enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_allows_fetch_and_merge", "description": "Fork syncing was enabled or disabled for a read-only branch", - "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_branch_enforcement_level", "description": "The enforcement of a branch lock was updated.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_name", "description": "A branch name pattern was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_pull_request_reviews_enforcement_level", "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_code_owner_review", "description": "Enforcement of required code owner review was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_last_push_approval", "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_approving_review_count", "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_status_checks_enforcement_level", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_signature_requirement_enforcement_level", "description": "Enforcement of required commit signing was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_strict_required_status_checks_policy", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.close", "description": "A pull request was closed without being merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.converted_to_draft", "description": "A pull request was converted to a draft.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create", "description": "A pull request was created.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create_review_request", "description": "A review was requested on a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.in_progress", "description": "A pull request was marked as in progress.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.indirect_merge", "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.merge", "description": "A pull request was merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.ready_for_review", "description": "A pull request was marked as ready for review.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.rebase", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.remove_review_request", "description": "A review request was removed from a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.reopen", "description": "A pull request was reopened after previously being closed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.create", "description": "A review comment was added to a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.delete", "description": "A review comment on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.update", "description": "A review comment on a pull request was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.delete", "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.dismiss", "description": "A review on a pull request was dismissed.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.submit", "description": "A review on a pull request was submitted.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_disabled", "description": "Code scanning using the default setup was disabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_enabled", "description": "Code scanning using the default setup was enabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "request_category", + "request_method", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "request_category", + "request_method", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.disk_archive", "description": "A repository was archived on disk.", - "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories" + "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.download_zip", "description": "A source code archive of a repository was downloaded as a ZIP file.", - "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives" + "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.hide_from_discovery", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.noindex", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.override_unlock", "description": "The repository was unlocked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_build", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_soft_delete", "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_soft_delete_restore", "description": "A GitHub Pages site that was previously soft-deleted was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.require_login", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.temporary_access_granted", "description": "Temporary access was enabled for a repository.", - "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repo_was", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "changes", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_branch", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_branch", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_branch_protection_evaluation.disable", "description": "Branch protections were disabled for the repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_branch_protection_evaluation.enable", "description": "Branch protections were enabled for this repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.disable", "description": "Secret scanning was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.enable", "description": "Secret scanning was enabled for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.disable", "description": "Secret scanning push protection was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.enable", "description": "Secret scanning push protection was enabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.disable", "description": "Email notification restrictions for an organization or enterprise were disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.enable", "description": "Email notification restrictions for an organization or enterprise were enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.create", "description": "GitHub detected a secret and created a secret scanning alert.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.reopen", "description": "A seret scanning alert was reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.resolve", "description": "A seret scanning alert was resolved.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.revoke", "description": "A secret scanning alert was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.disable", "description": "Secret scanning was disabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.enable", "description": "Secret scanning was enabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.disable", "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.enable", "description": "Secret scanning was enabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_push_protection.bypass", "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.register", "description": "A security key was registered for an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.remove", "description": "A security key was removed from an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_update_newsletter_send", "description": "Triggered when you send an email update to your sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsors_patreon_user_create", "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "patreon_email", + "patreon_username", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsors_patreon_user_destroy", "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "patreon_email", + "patreon_username", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.waitlist_join", "description": "You join the waitlist to join GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.create", "description": "An SSH certificate authority for an organization or enterprise was created.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.destroy", "description": "An SSH certificate authority for an organization or enterprise was deleted.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.disable", "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.enable", "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.set_domain_token_expiration", "description": "The verification code expiry time for an organization or enterprise domain was set.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.unverify_domain", "description": "An organization or enterprise domain was unverified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.verify_domain", "description": "An organization or enterprise domain was verified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.accept", "description": "Triggered when you accept a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.cancel", "description": "Triggered when you cancel a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.create", "description": "Triggered when you create a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.decline", "description": "Triggered when you decline a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.revoke", "description": "Triggered when you revoke a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_member", "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_repository", "description": "A team was given access and permissions to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_parent_team", "description": "A child team was created or a child team's parent was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" + "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_privacy", "description": "A team's privacy level was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility" + "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.create", "description": "A new team is created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.demote_maintainer", "description": "A user was demoted from a team maintainer to a team member.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.destroy", "description": "A team was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.clear", "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.disable", "description": "Team discussions were disabled for an organization.", - "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization" + "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.enable", "description": "Team discussions were enabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.promote_maintainer", "description": "A user was promoted from a team member to a team maintainer.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_member", "description": "An organization member was removed from a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.rename", "description": "A team's name was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.disabled", "description": "Team synchronization with a tenant was disabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.enabled", "description": "Team synchronization with a tenant was enabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.register", "description": "A new trusted device was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.remove", "description": "A trusted device was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.abort", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.complete", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.ignore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_approve", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_decline", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.start", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.two_factor_destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.add_factor", "description": "A secondary authentication factor was added to a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.disabled", "description": "Two-factor authentication was disabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.enabled", "description": "Two-factor authentication was enabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.password_reset_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.recovery_codes_regenerated", "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.remove_factor", "description": "A secondary authentication factor was removed from a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.sign_in_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.update_fallback", "description": "The two-factor authentication fallback for a user account was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.add_email", "description": "An email address was added to a user account.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.async_delete", "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.audit_log_export", "description": "Audit log entries were exported.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.block_user", "description": "A user was blocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.change_password", "description": "A user changed their password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_granted", "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_revoked", "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_device", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_device_and_location", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_location", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create", "description": "A new user account was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create_integration_secret", "description": "A user secret for Codespaces was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.creation_rate_limit_exceeded", "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.delete", "description": "A user account was destroyed by an asynchronous job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.demote", "description": "A site administrator was demoted to an ordinary user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.destroy", "description": "A user deleted his or her account, triggering user.async_delete.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_failure", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_requested", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_success", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.failed_login", "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.flag_as_large_scale_contributor", "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.forgot_password", "description": "A user requested a password reset.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.grant_github_developer", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.hide_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.login", "description": "A user signed in.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.logout", "description": "A user signed out.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.minimize_comment", "description": "A comment made by a user was minimized.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.new_device_used", "description": "A user signed in from a new device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.partial_two_factor_email_followup", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.promote", "description": "An ordinary user account was promoted to a site administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.recreate", "description": "A user's account was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_email", "description": "An email address was removed from a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_integration_secret", "description": "A user secret for Codespaces was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_large_scale_contributor_flag", "description": "A user account was no longer flagged as a large scale contributor.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.rename", "description": "A username was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.report_abuse", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.report_content", "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.reset_password", "description": "A user reset their account password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_session.country_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.show_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device", "description": "A user signed in from an unrecognized device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device_and_location", "description": "A user signed in from an unrecognized device and location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_location", "description": "A user signed in from an unrecognized location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.destroy", "description": "Triggered when you clear the status on your profile.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.update", "description": "Triggered when you set or change the status on your profile.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.suspend", "description": "A user account was suspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.toggle_warn_private_email", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_failure", "description": "A 2FA challenge issued for a user account failed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_success", "description": "A 2FA challenge issued for a user account succeeded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recover", "description": "A user used their 2FA recovery codes.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_downloaded", "description": "A user downloaded 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_printed", "description": "A user printed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_viewed", "description": "A user viewed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_requested", "description": "A user was prompted for a two-factor authentication code.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unblock_user", "description": "A user was unblocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unminimize_comment", "description": "A comment made by a user was unminimized.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unsuspend", "description": "A user account was unsuspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_integration_secret", "description": "A user secret for Codespaces was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_new_repository_default_branch_setting", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.cancel_workflow_run", "description": "A workflow run was cancelled.", - "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow" + "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.completed_workflow_run", "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history" + "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.created_workflow_run", "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow" + "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.prepared_workflow_job", "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows" + "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.rerun_workflow_run", "description": "A workflow run was re-run.", - "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs" + "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.12/organization.json b/src/audit-logs/data/ghes-3.12/organization.json index 330db5c782e3..115e48708bac 100644 --- a/src/audit-logs/data/ghes-3.12/organization.json +++ b/src/audit-logs/data/ghes-3.12/organization.json @@ -2,3171 +2,115602 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.accept", "description": "Credit was accepted for a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.create", "description": "Someone was added to the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.decline", "description": "Credit was declined for a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.destroy", "description": "Someone was removed from the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "auto_approve_personal_access_token_requests.disable", "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "auto_approve_personal_access_token_requests.enable", "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.attempted_to_create_from_prebuild", "description": "An attempt to create a codespace from a prebuild was made.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.business_enablement_updated", "description": "Enterprise setting for Codespaces ownership was updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_created", "description": "Policies were applied to codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_deleted", "description": "Policies were removed from codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_updated", "description": "Policies were updated for codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "commit_comment.destroy", "description": "A commit comment was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "commit_comment.update", "description": "A commit comment was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_org_settings_changed", "description": "Settings for Copilot Business were changed at the organization level.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_added", "description": "A seat was added to the Copilot Business subscription for a user and they have received access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_created", "description": "A seat assignment was newly created for a user.", - "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business" + "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_refreshed", "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_reused", "description": "A seat assignment was re-created for a user who already had a seat with no pending cancellation date.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_unassigned", "description": "A seat was unassigned from a user and they will lose access to GitHub Copilot at the end of the billing cycle.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled", "description": "A seat was canceled from the Copilot Business subscription and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled_by_staff", "description": "A seat was canceled from the Copilot Business subscription manually by GitHub and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_management_changed", "description": "The seat management setting was changed for the Copilot Business subscription.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.content_exclusion_changed", "description": "The excluded paths for GitHub Copilot were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "excluded_paths", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_definition.create", "description": "A new custom property definition was created.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "allowed_values", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "default_value", + "definition_id", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_allowed_values", + "old_base_role", + "old_default_value", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_required", + "old_role_permissions", + "old_user", + "old_value_type", + "old_values_editable_by", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value_type", + "values_editable_by", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_definition.destroy", "description": "A custom property definition was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "allowed_values", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "default_value", + "definition_id", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_allowed_values", + "old_base_role", + "old_default_value", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_required", + "old_role_permissions", + "old_user", + "old_value_type", + "old_values_editable_by", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value_type", + "values_editable_by", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_definition.update", "description": "A custom property definition was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "allowed_values", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "default_value", + "definition_id", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_allowed_values", + "old_base_role", + "old_default_value", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_required", + "old_role_permissions", + "old_user", + "old_value_type", + "old_values_editable_by", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value_type", + "values_editable_by", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_value.create", "description": "A repository's custom property value was manually set for the first time.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "definition_id", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_value.destroy", "description": "A repository's custom property value was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "definition_id", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_value.update", "description": "A repository's custom property value was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "definition_id", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_comment.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_comment.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.destroy", "description": "Triggered when a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.destroy", "description": "Triggered when a reply to a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.update", "description": "Triggered when a reply to a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.update", "description": "Triggered when a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_installation.create", "description": "The GitHub App associated with a GitHub Connect connection was created.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_installation.destroy", "description": "The GitHub App associated with a GitHub Connect connection was deleted.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git.clone", "description": "A repository was cloned.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.fetch", "description": "Changes were fetched from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.push", "description": "Changes were pushed to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation_request.close", "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reason", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation_request.create", "description": "A member requested that an owner install a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable", "description": "An IP allow list was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_for_installed_apps", "description": "An IP allow list was disabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable", "description": "An IP allow list was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_for_installed_apps", "description": "An IP allow list was enabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.create", "description": "An IP address was added to an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.destroy", "description": "An IP address was deleted from an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.update", "description": "An IP address or its description was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue_comment.destroy", "description": "A comment on an issue was deleted from the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.destroy", "description": "An issue was deleted from the repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue" + "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.pinned", "description": "An issue was pinned to a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.transfer", "description": "An issue was transferred to another repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.unpinned", "description": "An issue was unpinned from a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_disabled", "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_enabled", "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_policy_cleared", "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_pages.disable", "description": "The ability for members to publish GitHub Pages sites was disabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_pages.enable", "description": "The ability for members to publish GitHub Pages sites was enabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_private_pages.disable", "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_private_pages.enable", "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_public_pages.disable", "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_public_pages.enable", "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.clear", "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.disable", "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.enable", "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.clear", "description": "An enterprise owner cleared the policy setting for viewing dependency insights in any organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.disable", "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.enable", "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.destroy_file", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.download", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.accept_business_invitation", "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_billing_manager", "description": "A billing manager was added to an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_disabled", "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_enabled", "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.allow_third_party_access_requests_from_outside_collaborators_disabled", "description": "Third-party application access for outside collaborators was disabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled", "description": "Third-party application access for outside collaborators was enabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.archive", "description": "The organization was archived.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.audit_log_export", "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.audit_log_git_event_export", "description": "An export of the organization's Git events was created.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.billing_signup_error", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.block_user", "description": "An organization owner blocked a user from accessing the organization's repositories.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_business_invitation", "description": "An invitation for an organization to join an enterprise was revoked", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_invitation", "description": "An invitation sent to a user to join an organization was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.clear_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_enabled", "description": "Code scanning using the default setup was enabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_access_updated", "description": "Access to use Codespaces on internal and private repositories was updated for an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_ownership_updated", "description": "Ownership and payment for codespaces was updated for an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_team_access_allowed", "description": "A team has been allowed to use Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_team_access_revoked", "description": "A team has been prevented from using Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_user_access_allowed", "description": "A user has been allowed to use Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_user_access_revoked", "description": "A user has been prevented from using Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.confirm_business_invitation", "description": "An invitation for an organization to join an enterprise was confirmed.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.connect_usage_metrics_export", "description": "Server statistics were exported for the organization.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create", "description": "An organization was created.", - "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" + "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_actions_secret", "description": "A GitHub Actions secret was created for an organization.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_integration_secret", "description": "An integration secret was created for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.deauthorize", "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.grant", "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.revoke", "description": "An owner revoked authorized credentials.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_member_team_creation_permission", "description": "Team creation was limited to owners.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were disabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_reader_discussion_creation_permission", "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_saml", "description": "SAML single sign-on was disabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the organization was disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_two_factor_requirement", "description": "A two-factor authentication requirement was disabled for the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_disabled", "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_enabled", "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_member_team_creation_permission", "description": "Team creation by members was allowed.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were enabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_reader_discussion_creation_permission", "description": "An organization owner allowed users with read access to create discussions in an organization", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_saml", "description": "SAML single sign-on was enabled for the organization.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the organization was enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_two_factor_requirement", "description": "Two-factor authentication is now required for the organization.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_added", "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_removed", "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_member", "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_to_business", "description": "An organization was invited to join an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_approved", "description": "Access to an organization was granted for an OAuth App.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_blocked", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_denied", "description": "Access was disabled for an OAuth App that was previously approved.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_requested", "description": "An organization member requested that an owner grant an OAuth App access to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_unblocked", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rate_limited_invites", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recovery_code_failed", "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reason", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recovery_code_used", "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recovery_codes_downloaded", "description": "An organization owner downloaded the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recovery_codes_generated", "description": "An organization owner generated the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recovery_codes_printed", "description": "An organization owner printed the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recovery_codes_viewed", "description": "An organization owner viewed the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_actions_secret", "description": "A GitHub Actions secret was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_billing_manager", "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_integration_secret", "description": "An integration secret was removed from an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_outside_collaborator", "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rename", "description": "An organization was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_create", "description": "Triggered when a required workflow is created.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_delete", "description": "Triggered when a required workflow is deleted.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_update", "description": "Triggered when a required workflow is updated.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.restore_member", "description": "An organization member was restored.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.revoke_external_identity", "description": "A member's linked identity was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.revoke_sso_session", "description": "A member's SAML session was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_created", "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_removed", "description": "A self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_renamed", "description": "A self-hosted runner group was renamed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runner_removed", "description": "The REST API was used to remove a self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_added", "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_updated", "description": "A runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_updated", "description": "The configuration of a self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_visiblity_updated", "description": "The visibility of a self-hosted runner group was updated via the REST API.", - "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_generic_secrets.disabled", "description": "Generic secrets have been disabled at the organization level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_generic_secrets.enabled", "description": "Generic secrets have been enabled at the organization level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_disabled", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_enabled", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_updated", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_disable", "description": "Push protection for secret scanning was disabled.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_enable", "description": "Push protection for secret scanning was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_disable", "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_enable", "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transfer", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transfer_outgoing", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.unarchive", "description": "The organization was unarchived.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.unblock_user", "description": "A user was unblocked from an organization.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_settings", "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_default_repository_permission", "description": "The default repository permission level for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_integration_secret", "description": "An integration secret was updated for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_new_repository_default_branch_setting", "description": "The name of the default branch was changed for new repositories in the organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_repo_self_hosted_runners_policy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_emu_repo_runners_policy", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_repo_runners_policy", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_emu_repo_runners_policy", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_repo_runners_policy", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_saml_provider_settings", "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_terms_of_service", "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", - "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" + "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.create", "description": "A default label was created for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.destroy", "description": "A default label was deleted for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.update", "description": "A default label was edited for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.approve", "description": "A domain was approved for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.create", "description": "A domain was added to an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.destroy", "description": "A domain was removed from an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.verify", "description": "A domain was verified for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.add_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.add_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.remove_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.remove_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.clear", "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.disable", "description": "Organization projects were disabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.enable", "description": "Organization projects were enabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_role.assign", "description": "An organization role was assigned to a user or team.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_role_id", + "organization_role_name", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_role.create", "description": "A custom organization role was created in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_role.destroy", "description": "A custom organization role was deleted in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_role.revoke", "description": "A user or team was unassigned an organization role.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_role_id", + "organization_role_name", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_role.update", "description": "A custom organization role was edited in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_deleted", "description": "An entire package was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_published", "description": "A package was published or republished to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_deleted", "description": "A specific package version was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_published", "description": "A specific package version was published or republished to a package.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.create", "description": "A GitHub Codespaces prebuild configuration for a repository was created.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.destroy", "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.run_triggered", "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.update", "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.clear", "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.disable", "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.enable", "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.authorized_users_teams", "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.branch_allowances", "description": "A protected branch allowance was given to a specific user, team or integration.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "authorized_actors", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.create", "description": "Branch protection was enabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.destroy", "description": "Branch protection was disabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismiss_stale_reviews", "description": "Enforcement of dismissing stale pull requests was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismissal_restricted_users_teams", "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "authorized_actors", + "authorized_actors_only", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.policy_override", "description": "A branch protection requirement was overridden by a repository administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "after", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "before", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "compliant_pull_request_ids", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "overridden_codes", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reasons", + "referrer", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.rejected_ref_update", "description": "A branch update attempt was rejected.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_admin_enforced", "description": "Branch protection was enforced for repository administrators.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_deletions_enforcement_level", "description": "Branch deletion was enabled or disabled for a protected branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_force_pushes_enforcement_level", "description": "Force pushes were enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_ignore_approvals_from_contributors", "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_linear_history_requirement_enforcement_level", "description": "Required linear commit history was enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_allows_fetch_and_merge", "description": "Fork syncing was enabled or disabled for a read-only branch", - "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_branch_enforcement_level", "description": "The enforcement of a branch lock was updated.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_name", "description": "A branch name pattern was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_pull_request_reviews_enforcement_level", "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_code_owner_review", "description": "Enforcement of required code owner review was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_last_push_approval", "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_approving_review_count", "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_status_checks_enforcement_level", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_signature_requirement_enforcement_level", "description": "Enforcement of required commit signing was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_strict_required_status_checks_policy", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.close", "description": "A pull request was closed without being merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.converted_to_draft", "description": "A pull request was converted to a draft.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create", "description": "A pull request was created.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create_review_request", "description": "A review was requested on a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.in_progress", "description": "A pull request was marked as in progress.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.indirect_merge", "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.merge", "description": "A pull request was merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.ready_for_review", "description": "A pull request was marked as ready for review.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.rebase", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.remove_review_request", "description": "A review request was removed from a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.reopen", "description": "A pull request was reopened after previously being closed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.create", "description": "A review comment was added to a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.delete", "description": "A review comment on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.update", "description": "A review comment on a pull request was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.delete", "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.dismiss", "description": "A review on a pull request was dismissed.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.submit", "description": "A review on a pull request was submitted.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_disabled", "description": "Code scanning using the default setup was disabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_enabled", "description": "Code scanning using the default setup was enabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to this repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to this repository was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "request_category", + "request_method", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "request_category", + "request_method", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.download_zip", "description": "A source code archive of a repository was downloaded as a ZIP file.", - "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives" + "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_soft_delete", "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_soft_delete_restore", "description": "A GitHub Pages site that was previously soft-deleted was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename_branch", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "changes", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_branch", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_branch", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repo_was", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "changes", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_branch", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_branch", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.close", "description": "Someone closed a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.cve_request", "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.github_broadcast", "description": "GitHub made a security advisory public in the GitHub Advisory Database.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.github_withdraw", "description": "GitHub withdrew a security advisory that was published in error.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.open", "description": "Someone opened a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.publish", "description": "Someone published a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.reopen", "description": "Someone reopened as draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.update", "description": "Someone edited a draft or published security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_branch_protection_evaluation.disable", "description": "Branch protections were disabled for the repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_branch_protection_evaluation.enable", "description": "Branch protections were enabled for this repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_content_analysis.disable", "description": "Data use settings were disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_content_analysis.enable", "description": "Data use settings were enabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_dependency_graph.disable", "description": "The dependency graph was disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_dependency_graph.enable", "description": "The dependency graph was enabled for a private repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.clear", "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.disable", "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.enable", "description": "Repository projects were enabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.disable", "description": "Secret scanning was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.enable", "description": "Secret scanning was enabled for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_generic_secrets.disabled", "description": "Generic secrets have been disabled at the repository level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_generic_secrets.enabled", "description": "Generic secrets have been enabled at the repository level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.disable", "description": "Secret scanning push protection was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.enable", "description": "Secret scanning push protection was enabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.clear", "description": "The repository visibility change setting was cleared for an organization or enterprise.", - "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility" + "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.disable", "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.enable", "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.auto_dismiss", "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.auto_reopen", "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.create", "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.dismiss", "description": "A Dependabot alert was manually dismissed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.reintroduce", "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.reopen", "description": "A Dependabot alert was manually reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.resolve", "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.authorized_users_teams", "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts_auto_dismissal.disable", "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts_auto_dismissal.enable", "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.disable", "description": "Dependabot alerts was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.enable", "description": "Dependabot alerts was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "required_status_check.create", "description": "A status check was marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "context", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "required_status_check.destroy", "description": "A status check was no longer marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "context", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.disable", "description": "Email notification restrictions for an organization or enterprise were disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.enable", "description": "Email notification restrictions for an organization or enterprise were enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.create", "description": "A new custom repository role was created.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.destroy", "description": "A custom repository role was deleted.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.update", "description": "A custom repository role was edited.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.create", "description": "GitHub detected a secret and created a secret scanning alert.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.reopen", "description": "A seret scanning alert was reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.resolve", "description": "A seret scanning alert was resolved.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.revoke", "description": "A secret scanning alert was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.disable", "description": "Secret scanning was disabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.enable", "description": "Secret scanning was enabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.disable", "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.enable", "description": "Secret scanning was enabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_push_protection.bypass", "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.invoiced_agreement_sign", "description": "An agreement for invoiced billing for GitHub Sponsors was signed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsors_patreon_user_create", "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "patreon_email", + "patreon_username", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsors_patreon_user_destroy", "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "patreon_email", + "patreon_username", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.create", "description": "An SSH certificate authority for an organization or enterprise was created.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.destroy", "description": "An SSH certificate authority for an organization or enterprise was deleted.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.disable", "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.enable", "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.dependabot_debug_credentials_generated", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.set_domain_token_expiration", "description": "The verification code expiry time for an organization or enterprise domain was set.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.unverify_domain", "description": "An organization or enterprise domain was unverified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.verify_domain", "description": "An organization or enterprise domain was verified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_member", "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_repository", "description": "A team was given access and permissions to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_parent_team", "description": "A child team was created or a child team's parent was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" + "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_privacy", "description": "A team's privacy level was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility" + "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.create", "description": "A new team is created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.demote_maintainer", "description": "A user was demoted from a team maintainer to a team member.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.destroy", "description": "A team was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.clear", "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.disable", "description": "Team discussions were disabled for an organization.", - "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization" + "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.enable", "description": "Team discussions were enabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.promote_maintainer", "description": "A user was promoted from a team member to a team maintainer.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_member", "description": "An organization member was removed from a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.rename", "description": "A team's name was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.disabled", "description": "Team synchronization with a tenant was disabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.enabled", "description": "Team synchronization with a tenant was enabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.update_okta_credentials", "description": "The Okta credentials for team synchronization with a tenant were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.create", "description": "A Dependabot rule was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "vulnerability_alert_rule_actions", + "vulnerability_alert_rule_conditions", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.delete", "description": "A Dependabot rule was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "vulnerability_alert_rule_actions", + "vulnerability_alert_rule_conditions", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.disable", "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "vulnerability_alert_rule_actions", + "vulnerability_alert_rule_conditions", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.enable", "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "vulnerability_alert_rule_actions", + "vulnerability_alert_rule_conditions", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.force_disable", "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "vulnerability_alert_rule_actions", + "vulnerability_alert_rule_conditions", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.force_enable", "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.update", "description": "A Dependabot rule's conditions, actions, or metadata changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "vulnerability_alert_rule_actions", + "vulnerability_alert_rule_conditions", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.cancel_workflow_run", "description": "A workflow run was cancelled.", - "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow" + "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.completed_workflow_run", "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history" + "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.created_workflow_run", "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow" + "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.prepared_workflow_job", "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows" + "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.rerun_workflow_run", "description": "A workflow run was re-run.", - "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs" + "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.12/user.json b/src/audit-logs/data/ghes-3.12/user.json index 5f1ce5f39c1c..c23dbc81c6fb 100644 --- a/src/audit-logs/data/ghes-3.12/user.json +++ b/src/audit-logs/data/ghes-3.12/user.json @@ -2,1836 +2,67172 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.confirm", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.recover", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.update_bill_cycle_day", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_fork_pr_approvals_policy", "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_added", "description": "A seat was added to the Copilot Business subscription for a user and they have received access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_created", "description": "A seat assignment was newly created for a user.", - "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business" + "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_refreshed", "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_reused", "description": "A seat assignment was re-created for a user who already had a seat with no pending cancellation date.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_unassigned", "description": "A seat was unassigned from a user and they will lose access to GitHub Copilot at the end of the billing cycle.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled", "description": "A seat was canceled from the Copilot Business subscription and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled_by_staff", "description": "A seat was canceled from the Copilot Business subscription manually by GitHub and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.create", "description": "An SSH key was added to a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.delete", "description": "An SSH key was removed from a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.publish", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.retire", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.create", "description": "An OAuth access token was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.destroy", "description": "An OAuth access token was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.regenerate", "description": "An OAuth access token was regenerated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.update", "description": "An OAuth access token was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.create", "description": "An authorization for an OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.destroy", "description": "An authorization for an OAuth application was deleted.", - "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations" + "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.register", "description": "A new passkey was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.remove", "description": "A new passkey was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.create", "description": "Triggered when you create a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_regenerated", "description": "Triggered when you regenerate a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_revoked", "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", - "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users" + "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.destroy", "description": "Triggered when you delete a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.update", "description": "A fine-grained personal access token was updated.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "request_category", + "request_method", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "request_category", + "request_method", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_soft_delete", "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_soft_delete_restore", "description": "A GitHub Pages site that was previously soft-deleted was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.temporary_access_granted", "description": "Temporary access was enabled for a repository.", - "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repo_was", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "changes", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_branch", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_branch", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.register", "description": "A security key was registered for an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.remove", "description": "A security key was removed from an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_update_newsletter_send", "description": "Triggered when you send an email update to your sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsors_patreon_user_create", "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "patreon_email", + "patreon_username", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsors_patreon_user_destroy", "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "patreon_email", + "patreon_username", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.waitlist_join", "description": "You join the waitlist to join GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.accept", "description": "Triggered when you accept a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.cancel", "description": "Triggered when you cancel a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.create", "description": "Triggered when you create a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.decline", "description": "Triggered when you decline a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.revoke", "description": "Triggered when you revoke a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.register", "description": "A new trusted device was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.remove", "description": "A trusted device was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.abort", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.complete", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.ignore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_approve", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_decline", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.start", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.two_factor_destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.add_factor", "description": "A secondary authentication factor was added to a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.disabled", "description": "Two-factor authentication was disabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.enabled", "description": "Two-factor authentication was enabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.password_reset_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.recovery_codes_regenerated", "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.remove_factor", "description": "A secondary authentication factor was removed from a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.sign_in_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.update_fallback", "description": "The two-factor authentication fallback for a user account was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.add_email", "description": "An email address was added to a user account.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.async_delete", "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.audit_log_export", "description": "Audit log entries were exported.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.block_user", "description": "A user was blocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.change_password", "description": "A user changed their password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_granted", "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_revoked", "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create", "description": "A new user account was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create_integration_secret", "description": "A user secret for Codespaces was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.creation_rate_limit_exceeded", "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.delete", "description": "A user account was destroyed by an asynchronous job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.demote", "description": "A site administrator was demoted to an ordinary user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.destroy", "description": "A user deleted his or her account, triggering user.async_delete.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_failure", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_requested", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_success", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.failed_login", "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.forgot_password", "description": "A user requested a password reset.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.grant_github_developer", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.hide_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.login", "description": "A user signed in.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.logout", "description": "A user signed out.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.new_device_used", "description": "A user signed in from a new device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.promote", "description": "An ordinary user account was promoted to a site administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.recreate", "description": "A user's account was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_email", "description": "An email address was removed from a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_integration_secret", "description": "A user secret for Codespaces was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.rename", "description": "A username was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.reset_password", "description": "A user reset their account password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_session.country_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.show_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device", "description": "A user signed in from an unrecognized device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device_and_location", "description": "A user signed in from an unrecognized device and location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.destroy", "description": "Triggered when you clear the status on your profile.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.update", "description": "Triggered when you set or change the status on your profile.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.suspend", "description": "A user account was suspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.toggle_warn_private_email", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_failure", "description": "A 2FA challenge issued for a user account failed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_success", "description": "A 2FA challenge issued for a user account succeeded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recover", "description": "A user used their 2FA recovery codes.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_downloaded", "description": "A user downloaded 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_printed", "description": "A user printed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_viewed", "description": "A user viewed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_requested", "description": "A user was prompted for a two-factor authentication code.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unblock_user", "description": "A user was unblocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unsuspend", "description": "A user account was unsuspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_integration_secret", "description": "A user secret for Codespaces was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_new_repository_default_branch_setting", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.13/enterprise.json b/src/audit-logs/data/ghes-3.13/enterprise.json index 33de4c275d68..732c9ddef4d0 100644 --- a/src/audit-logs/data/ghes-3.13/enterprise.json +++ b/src/audit-logs/data/ghes-3.13/enterprise.json @@ -2,3381 +2,123951 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.confirm", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.recover", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "api.request", "description": "An API request was made to a security-significant endpoint for the enterprise. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "query_string", + "rate_limit_remaining", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_body", + "request_cancelled", + "request_method", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "route", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "status_code", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url_path", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.update_bill_cycle_day", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.add_admin", "description": "An enterprise owner was added to an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.add_organization", "description": "An organization was added to an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.disabled", "description": "GitHub Advanced Security was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.disabled_for_new_user_namespace_repos", "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.enabled", "description": "GitHub Advanced Security was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.enabled_for_new_user_namespace_repos", "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.advanced_security_policy_update", "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.advanced_security_repo_admin_enablement_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.user_namespace_repos_disabled", "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.user_namespace_repos_enabled", "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_actions_settings", "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_default_repository_permission", "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_members_can_create_repos", "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.create", "description": "An enterprise was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for new repositories in your enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for new repositories in your enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.dependabot_alerts_repo_admin_enablement_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.disable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the enterprise was disabled.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.disable_two_factor_requirement", "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.enable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the enterprise was enabled.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.enable_two_factor_requirement", "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.clear", "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.remove_admin", "description": "An enterprise owner was removed from an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.remove_organization", "description": "An organization was removed from an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.rename_slug", "description": "The slug for the enterprise URL was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the business level", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the business level", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise#managing-advanced-security-features", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.create", "description": "An enterprise-level custom pattern was created for secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.delete", "description": "An enterprise-level custom pattern was removed from secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.publish", "description": "An enterprise-level custom pattern was published for secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.update", "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.disable", "description": "Secret scanning was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.disabled_for_new_repos", "description": "Secret scanning was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.enable", "description": "Secret scanning was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.enabled_for_new_repos", "description": "Secret scanning was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.disable", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.enable", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.update", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.disable", "description": "Push protection for secret scanning was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.disabled_for_new_repos", "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.enable", "description": "Push protection for secret scanning was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.enabled_for_new_repos", "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.secret_scanning_repo_admin_settings_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_fork_pr_approvals_policy", "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_actions_settings", "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_default_repository_permission", "description": "The base repository permission setting was updated for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_member_repository_creation_permission", "description": "The repository creation setting was updated for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_member_repository_invitation_permission", "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "devcontainer_path", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "machine_type", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "devcontainer_path", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "machine_type", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.start_environment", "description": "A codespace was started.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "devcontainer_path", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "machine_type", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "devcontainer_path", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "machine_type", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_added", "description": "A seat was added to the Copilot Business subscription for a user and they have received access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_created", "description": "A seat assignment was newly created for a user.", - "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business" + "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_refreshed", "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_reused", "description": "A seat assignment was re-created for a user who already had a seat with no pending cancellation date.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_unassigned", "description": "A seat was unassigned from a user and they will lose access to GitHub Copilot at the end of the billing cycle.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled", "description": "A seat was canceled from the Copilot Business subscription and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled_by_staff", "description": "A seat was canceled from the Copilot Business subscription manually by GitHub and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_definition.create", "description": "A new custom property definition was created.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "allowed_values", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "default_value", + "definition_id", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_allowed_values", + "old_base_role", + "old_default_value", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_required", + "old_role_permissions", + "old_user", + "old_value_type", + "old_values_editable_by", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value_type", + "values_editable_by", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_definition.destroy", "description": "A custom property definition was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "allowed_values", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "default_value", + "definition_id", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_allowed_values", + "old_base_role", + "old_default_value", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_required", + "old_role_permissions", + "old_user", + "old_value_type", + "old_values_editable_by", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value_type", + "values_editable_by", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_definition.update", "description": "A custom property definition was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "allowed_values", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "default_value", + "definition_id", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_allowed_values", + "old_base_role", + "old_default_value", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_required", + "old_role_permissions", + "old_user", + "old_value_type", + "old_values_editable_by", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value_type", + "values_editable_by", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_value.create", "description": "A repository's custom property value was manually set for the first time.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "definition_id", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_value.destroy", "description": "A repository's custom property value was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "definition_id", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_value.update", "description": "A repository's custom property value was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "definition_id", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.destroy", "description": "Triggered when a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.destroy", "description": "Triggered when a reply to a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.update", "description": "Triggered when a reply to a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.update", "description": "Triggered when a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.create", "description": "A global announcement banner was created for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.destroy", "description": "A global announcement banner was removed from the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.update", "description": "A global announcement banner was updated for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.approve", "description": "A domain was approved for an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.create", "description": "A domain was added to an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.destroy", "description": "A domain was removed from an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.verify", "description": "A domain was verified for an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.register_self_hosted_runner", "description": "A new GitHub Actions self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.remove_self_hosted_runner", "description": "A GitHub Actions self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_created", "description": "A GitHub Actions self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_removed", "description": "A GitHub Actions self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runner_removed", "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runners_added", "description": "A GitHub Actions self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runners_updated", "description": "A GitHub Actions runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_updated", "description": "The configuration of a GitHub Actions self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_offline", "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_online", "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_updated", "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git.clone", "description": "A repository was cloned.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.fetch", "description": "Changes were fetched from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.push", "description": "Changes were pushed to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git_signing_ssh_public_key.create", "description": "An SSH key was added to a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.delete", "description": "An SSH key was removed from a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation" + "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation" + "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable", "description": "An IP allow list was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_for_installed_apps", "description": "An IP allow list was disabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_user_level_enforcement", "description": "IP allow list user level enforcement was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable", "description": "An IP allow list was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_for_installed_apps", "description": "An IP allow list was enabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_user_level_enforcement", "description": "IP allow list user level enforcement was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.create", "description": "An IP address was added to an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.destroy", "description": "An IP address was deleted from an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.update", "description": "An IP address or its description was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.publish", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.retire", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.create", "description": "An OAuth access token was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.destroy", "description": "An OAuth access token was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.regenerate", "description": "An OAuth access token was regenerated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.update", "description": "An OAuth access token was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.suspend", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.unsuspend", "description": "An OAuth application was unsuspended for a user or organization account.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.create", "description": "An authorization for an OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.destroy", "description": "An authorization for an OAuth application was deleted.", - "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations" + "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.update", "description": "An authorization for an OAuth application was updated.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.accept_business_invitation", "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_billing_manager", "description": "A billing manager was added to an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_disabled", "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_enabled", "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.async_delete", "description": "A user initiated a background job to delete an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.billing_signup_error", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.block_user", "description": "An organization owner blocked a user from accessing the organization's repositories.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_business_invitation", "description": "An invitation for an organization to join an enterprise was revoked", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_invitation", "description": "An invitation sent to a user to join an organization was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.clear_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_enabled", "description": "Code scanning using the default setup was enabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.confirm_business_invitation", "description": "An invitation for an organization to join an enterprise was confirmed.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create", "description": "An organization was created.", - "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" + "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.delete", "description": "An organization was deleted by a user-initiated background job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_member_team_creation_permission", "description": "Team creation was limited to owners.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_reader_discussion_creation_permission", "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_saml", "description": "SAML single sign-on was disabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_two_factor_requirement", "description": "A two-factor authentication requirement was disabled for the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_disabled", "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_enabled", "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_member_team_creation_permission", "description": "Team creation by members was allowed.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_reader_discussion_creation_permission", "description": "An organization owner allowed users with read access to create discussions in an organization", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_saml", "description": "SAML single sign-on was enabled for the organization.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_two_factor_requirement", "description": "Two-factor authentication is now required for the organization.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_added", "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_removed", "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_member", "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_to_business", "description": "An organization was invited to join an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rate_limited_invites", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recreate", "description": "An organization was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_billing_manager", "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_outside_collaborator", "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rename", "description": "An organization was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.restore_member", "description": "An organization member was restored.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_created", "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_removed", "description": "A self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runner_removed", "description": "The REST API was used to remove a self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_added", "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_updated", "description": "A runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_updated", "description": "The configuration of a self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_disabled", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_enabled", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_updated", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_disable", "description": "Push protection for secret scanning was disabled.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_enable", "description": "Push protection for secret scanning was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_disable", "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_enable", "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transform", "description": "A user account was converted into an organization.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.unblock_user", "description": "A user was unblocked from an organization.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_settings", "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_default_repository_permission", "description": "The default repository permission level for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_saml_provider_settings", "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_terms_of_service", "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", - "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" + "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.approve", "description": "A domain was approved for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.create", "description": "A domain was added to an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.destroy", "description": "A domain was removed from an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.verify", "description": "A domain was verified for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_deleted", "description": "An entire package was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_published", "description": "A package was published or republished to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_deleted", "description": "A specific package version was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_published", "description": "A specific package version was published or republished to a package.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.register", "description": "A new passkey was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.remove", "description": "A new passkey was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.create", "description": "Triggered when you create a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_regenerated", "description": "Triggered when you regenerate a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_revoked", "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", - "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users" + "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.destroy", "description": "Triggered when you delete a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.update", "description": "A fine-grained personal access token was updated.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.authorized_users_teams", "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.branch_allowances", "description": "A protected branch allowance was given to a specific user, team or integration.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "authorized_actors", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.create", "description": "Branch protection was enabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.destroy", "description": "Branch protection was disabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismiss_stale_reviews", "description": "Enforcement of dismissing stale pull requests was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismissal_restricted_users_teams", "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "authorized_actors", + "authorized_actors_only", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.policy_override", "description": "A branch protection requirement was overridden by a repository administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "after", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "before", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "compliant_pull_request_ids", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "overridden_codes", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reasons", + "referrer", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.rejected_ref_update", "description": "A branch update attempt was rejected.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_admin_enforced", "description": "Branch protection was enforced for repository administrators.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_deletions_enforcement_level", "description": "Branch deletion was enabled or disabled for a protected branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_force_pushes_enforcement_level", "description": "Force pushes were enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_ignore_approvals_from_contributors", "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_linear_history_requirement_enforcement_level", "description": "Required linear commit history was enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_allows_fetch_and_merge", "description": "Fork syncing was enabled or disabled for a read-only branch", - "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_branch_enforcement_level", "description": "The enforcement of a branch lock was updated.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_name", "description": "A branch name pattern was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_pull_request_reviews_enforcement_level", "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_code_owner_review", "description": "Enforcement of required code owner review was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_last_push_approval", "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_approving_review_count", "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_status_checks_enforcement_level", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_signature_requirement_enforcement_level", "description": "Enforcement of required commit signing was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_strict_required_status_checks_policy", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.close", "description": "A pull request was closed without being merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.converted_to_draft", "description": "A pull request was converted to a draft.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create", "description": "A pull request was created.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create_review_request", "description": "A review was requested on a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.in_progress", "description": "A pull request was marked as in progress.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.indirect_merge", "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.merge", "description": "A pull request was merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.ready_for_review", "description": "A pull request was marked as ready for review.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.rebase", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.remove_review_request", "description": "A review request was removed from a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.reopen", "description": "A pull request was reopened after previously being closed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.create", "description": "A review comment was added to a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.delete", "description": "A review comment on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.update", "description": "A review comment on a pull request was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.delete", "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.dismiss", "description": "A review on a pull request was dismissed.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.submit", "description": "A review on a pull request was submitted.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_disabled", "description": "Code scanning using the default setup was disabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_enabled", "description": "Code scanning using the default setup was enabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "request_category", + "request_method", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "request_category", + "request_method", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.disk_archive", "description": "A repository was archived on disk.", - "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories" + "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.download_zip", "description": "A source code archive of a repository was downloaded as a ZIP file.", - "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives" + "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.hide_from_discovery", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.noindex", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.override_unlock", "description": "The repository was unlocked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_build", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_soft_delete", "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_soft_delete_restore", "description": "A GitHub Pages site that was previously soft-deleted was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.require_login", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.temporary_access_granted", "description": "Temporary access was enabled for a repository.", - "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repo_was", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "changes", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_branch", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_branch", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_branch_protection_evaluation.disable", "description": "Branch protections were disabled for the repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_branch_protection_evaluation.enable", "description": "Branch protections were enabled for this repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.disable", "description": "Secret scanning was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.enable", "description": "Secret scanning was enabled for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.disable", "description": "Secret scanning push protection was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.enable", "description": "Secret scanning push protection was enabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.disable", "description": "Email notification restrictions for an organization or enterprise were disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.enable", "description": "Email notification restrictions for an organization or enterprise were enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.create", "description": "GitHub detected a secret and created a secret scanning alert.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.reopen", "description": "A seret scanning alert was reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.resolve", "description": "A seret scanning alert was resolved.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.revoke", "description": "A secret scanning alert was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.validate", "description": "A secret scanning alert was validated.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.disable", "description": "Secret scanning was disabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.enable", "description": "Secret scanning was enabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.disable", "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.enable", "description": "Secret scanning was enabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_push_protection.bypass", "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.register", "description": "A security key was registered for an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.remove", "description": "A security key was removed from an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_update_newsletter_send", "description": "Triggered when you send an email update to your sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsors_patreon_user_create", "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "patreon_email", + "patreon_username", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsors_patreon_user_destroy", "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "patreon_email", + "patreon_username", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.waitlist_join", "description": "You join the waitlist to join GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.create", "description": "An SSH certificate authority for an organization or enterprise was created.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.destroy", "description": "An SSH certificate authority for an organization or enterprise was deleted.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.disable", "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.enable", "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.set_domain_token_expiration", "description": "The verification code expiry time for an organization or enterprise domain was set.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.unverify_domain", "description": "An organization or enterprise domain was unverified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.verify_domain", "description": "An organization or enterprise domain was verified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.accept", "description": "Triggered when you accept a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.cancel", "description": "Triggered when you cancel a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.create", "description": "Triggered when you create a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.decline", "description": "Triggered when you decline a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.revoke", "description": "Triggered when you revoke a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_member", "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_repository", "description": "A team was given access and permissions to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_parent_team", "description": "A child team was created or a child team's parent was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" + "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_privacy", "description": "A team's privacy level was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility" + "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.create", "description": "A new team is created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.demote_maintainer", "description": "A user was demoted from a team maintainer to a team member.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.destroy", "description": "A team was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.clear", "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.disable", "description": "Team discussions were disabled for an organization.", - "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization" + "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.enable", "description": "Team discussions were enabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.promote_maintainer", "description": "A user was promoted from a team member to a team maintainer.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_member", "description": "An organization member was removed from a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.rename", "description": "A team's name was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.disabled", "description": "Team synchronization with a tenant was disabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.enabled", "description": "Team synchronization with a tenant was enabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.register", "description": "A new trusted device was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.remove", "description": "A trusted device was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.abort", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.complete", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.ignore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_approve", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_decline", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.start", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.two_factor_destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.add_factor", "description": "A secondary authentication factor was added to a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.disabled", "description": "Two-factor authentication was disabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.enabled", "description": "Two-factor authentication was enabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.password_reset_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.recovery_codes_regenerated", "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.remove_factor", "description": "A secondary authentication factor was removed from a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.sign_in_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.update_fallback", "description": "The two-factor authentication fallback for a user account was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.add_email", "description": "An email address was added to a user account.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.async_delete", "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.audit_log_export", "description": "Audit log entries were exported.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "query_phrase", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.block_user", "description": "A user was blocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.change_password", "description": "A user changed their password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_granted", "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_revoked", "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_device", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_device_and_location", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_location", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create", "description": "A new user account was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create_integration_secret", "description": "A user secret for Codespaces was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.creation_rate_limit_exceeded", "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.delete", "description": "A user account was destroyed by an asynchronous job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.demote", "description": "A site administrator was demoted to an ordinary user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.destroy", "description": "A user deleted his or her account, triggering user.async_delete.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_failure", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_requested", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_success", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.failed_login", "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.flag_as_large_scale_contributor", "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.forgot_password", "description": "A user requested a password reset.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.grant_github_developer", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.hide_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.login", "description": "A user signed in.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.logout", "description": "A user signed out.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.minimize_comment", "description": "A comment made by a user was minimized.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.new_device_used", "description": "A user signed in from a new device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.partial_two_factor_email_followup", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.promote", "description": "An ordinary user account was promoted to a site administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.recreate", "description": "A user's account was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_email", "description": "An email address was removed from a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_integration_secret", "description": "A user secret for Codespaces was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_large_scale_contributor_flag", "description": "A user account was no longer flagged as a large scale contributor.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.rename", "description": "A username was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.report_abuse", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.report_content", "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.reset_password", "description": "A user reset their account password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_session.country_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.show_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device", "description": "A user signed in from an unrecognized device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device_and_location", "description": "A user signed in from an unrecognized device and location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_location", "description": "A user signed in from an unrecognized location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.destroy", "description": "Triggered when you clear the status on your profile.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.update", "description": "Triggered when you set or change the status on your profile.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.suspend", "description": "A user account was suspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.toggle_warn_private_email", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_failure", "description": "A 2FA challenge issued for a user account failed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_success", "description": "A 2FA challenge issued for a user account succeeded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recover", "description": "A user used their 2FA recovery codes.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_downloaded", "description": "A user downloaded 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_printed", "description": "A user printed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_viewed", "description": "A user viewed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_requested", "description": "A user was prompted for a two-factor authentication code.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unblock_user", "description": "A user was unblocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unminimize_comment", "description": "A comment made by a user was unminimized.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unsuspend", "description": "A user account was unsuspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_integration_secret", "description": "A user secret for Codespaces was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_new_repository_default_branch_setting", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.cancel_workflow_run", "description": "A workflow run was cancelled.", - "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow" + "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.completed_workflow_run", "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history" + "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.created_workflow_run", "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow" + "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.prepared_workflow_job", "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows" + "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.rerun_workflow_run", "description": "A workflow run was re-run.", - "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs" + "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.13/organization.json b/src/audit-logs/data/ghes-3.13/organization.json index 6688037011e3..e1577ae18be2 100644 --- a/src/audit-logs/data/ghes-3.13/organization.json +++ b/src/audit-logs/data/ghes-3.13/organization.json @@ -2,3211 +2,117691 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.accept", "description": "Credit was accepted for a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.create", "description": "Someone was added to the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.decline", "description": "Credit was declined for a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.destroy", "description": "Someone was removed from the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "auto_approve_personal_access_token_requests.disable", "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "auto_approve_personal_access_token_requests.enable", "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.attempted_to_create_from_prebuild", "description": "An attempt to create a codespace from a prebuild was made.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.business_enablement_updated", "description": "Enterprise setting for Codespaces ownership was updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "devcontainer_path", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "machine_type", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "devcontainer_path", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "machine_type", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_created", "description": "Policies were applied to codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_deleted", "description": "Policies were removed from codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_updated", "description": "Policies were updated for codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.start_environment", "description": "A codespace was started.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "devcontainer_path", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "machine_type", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "devcontainer_path", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "machine_type", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "commit_comment.destroy", "description": "A commit comment was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "commit_comment.update", "description": "A commit comment was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.access_revoked", "description": "The user's Copilot access was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "plan", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reason", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_org_settings_changed", "description": "Settings for Copilot Business were changed at the organization level.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_added", "description": "A seat was added to the Copilot Business subscription for a user and they have received access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_created", "description": "A seat assignment was newly created for a user.", - "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business" + "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_refreshed", "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_reused", "description": "A seat assignment was re-created for a user who already had a seat with no pending cancellation date.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_unassigned", "description": "A seat was unassigned from a user and they will lose access to GitHub Copilot at the end of the billing cycle.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled", "description": "A seat was canceled from the Copilot Business subscription and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled_by_staff", "description": "A seat was canceled from the Copilot Business subscription manually by GitHub and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_management_changed", "description": "The seat management setting was changed for the Copilot Business subscription.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.content_exclusion_changed", "description": "The excluded paths for GitHub Copilot were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "excluded_paths", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.knowledge_base_created", "description": "A knowledge base was created in the organization.", - "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases" + "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "knowledge_base_name", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.knowledge_base_deleted", "description": "A knowledge base was deleted from the organization.", - "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases" + "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "knowledge_base_name", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.knowledge_base_updated", "description": "A knowledge base was updated in the organization.", - "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases" + "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "knowledge_base_name", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_definition.create", "description": "A new custom property definition was created.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "allowed_values", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "default_value", + "definition_id", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_allowed_values", + "old_base_role", + "old_default_value", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_required", + "old_role_permissions", + "old_user", + "old_value_type", + "old_values_editable_by", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value_type", + "values_editable_by", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_definition.destroy", "description": "A custom property definition was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "allowed_values", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "default_value", + "definition_id", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_allowed_values", + "old_base_role", + "old_default_value", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_required", + "old_role_permissions", + "old_user", + "old_value_type", + "old_values_editable_by", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value_type", + "values_editable_by", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_definition.update", "description": "A custom property definition was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "allowed_values", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "default_value", + "definition_id", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_allowed_values", + "old_base_role", + "old_default_value", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_required", + "old_role_permissions", + "old_user", + "old_value_type", + "old_values_editable_by", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value_type", + "values_editable_by", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_value.create", "description": "A repository's custom property value was manually set for the first time.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "definition_id", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_value.destroy", "description": "A repository's custom property value was deleted.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "definition_id", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_property_value.update", "description": "A repository's custom property value was updated.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "definition_id", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "property_name", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "value", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_comment.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_comment.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.destroy", "description": "Triggered when a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.destroy", "description": "Triggered when a reply to a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.update", "description": "Triggered when a reply to a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.update", "description": "Triggered when a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_installation.create", "description": "The GitHub App associated with a GitHub Connect connection was created.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_installation.destroy", "description": "The GitHub App associated with a GitHub Connect connection was deleted.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git.clone", "description": "A repository was cloned.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.fetch", "description": "Changes were fetched from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.push", "description": "Changes were pushed to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "external_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation_request.close", "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reason", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation_request.create", "description": "A member requested that an owner install a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation" + "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation" + "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable", "description": "An IP allow list was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_for_installed_apps", "description": "An IP allow list was disabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable", "description": "An IP allow list was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_for_installed_apps", "description": "An IP allow list was enabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.create", "description": "An IP address was added to an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.destroy", "description": "An IP address was deleted from an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.update", "description": "An IP address or its description was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue_comment.destroy", "description": "A comment on an issue was deleted from the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.destroy", "description": "An issue was deleted from the repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue" + "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.pinned", "description": "An issue was pinned to a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.transfer", "description": "An issue was transferred to another repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.unpinned", "description": "An issue was unpinned from a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_disabled", "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_enabled", "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_policy_cleared", "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_pages.disable", "description": "The ability for members to publish GitHub Pages sites was disabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_pages.enable", "description": "The ability for members to publish GitHub Pages sites was enabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_private_pages.disable", "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_private_pages.enable", "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_public_pages.disable", "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_public_pages.enable", "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.clear", "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.disable", "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.enable", "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.clear", "description": "An enterprise owner cleared the policy setting for viewing dependency insights in any organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.disable", "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.enable", "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.destroy_file", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.download", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.accept_business_invitation", "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_billing_manager", "description": "A billing manager was added to an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_disabled", "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_enabled", "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.allow_third_party_access_requests_from_outside_collaborators_disabled", "description": "Third-party application access for outside collaborators was disabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled", "description": "Third-party application access for outside collaborators was enabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.archive", "description": "The organization was archived.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.audit_log_export", "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "query_phrase", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.audit_log_git_event_export", "description": "An export of the organization's Git events was created.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "end", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "start", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.billing_signup_error", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.block_user", "description": "An organization owner blocked a user from accessing the organization's repositories.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_business_invitation", "description": "An invitation for an organization to join an enterprise was revoked", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_invitation", "description": "An invitation sent to a user to join an organization was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.clear_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_enabled", "description": "Code scanning using the default setup was enabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_access_updated", "description": "Access to use Codespaces on internal and private repositories was updated for an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/enabling-or-disabling-github-codespaces-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_ownership_updated", "description": "Ownership and payment for codespaces was updated for an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_team_access_allowed", "description": "A team has been allowed to use Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_team_access_revoked", "description": "A team has been prevented from using Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_user_access_allowed", "description": "A user has been allowed to use Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_user_access_revoked", "description": "A user has been prevented from using Codespaces for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.confirm_business_invitation", "description": "An invitation for an organization to join an enterprise was confirmed.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.connect_usage_metrics_export", "description": "Server statistics were exported for the organization.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create", "description": "An organization was created.", - "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" + "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_actions_secret", "description": "A GitHub Actions secret was created for an organization.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_integration_secret", "description": "An integration secret was created for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.deauthorize", "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.grant", "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.revoke", "description": "An owner revoked authorized credentials.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_member_team_creation_permission", "description": "Team creation was limited to owners.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were disabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_reader_discussion_creation_permission", "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_saml", "description": "SAML single sign-on was disabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the organization was disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_two_factor_requirement", "description": "A two-factor authentication requirement was disabled for the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_disabled", "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_enabled", "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_member_team_creation_permission", "description": "Team creation by members was allowed.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were enabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_reader_discussion_creation_permission", "description": "An organization owner allowed users with read access to create discussions in an organization", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_saml", "description": "SAML single sign-on was enabled for the organization.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the organization was enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_two_factor_requirement", "description": "Two-factor authentication is now required for the organization.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_added", "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_removed", "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_member", "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_to_business", "description": "An organization was invited to join an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_approved", "description": "Access to an organization was granted for an OAuth App.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_blocked", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_denied", "description": "Access was disabled for an OAuth App that was previously approved.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_requested", "description": "An organization member requested that an owner grant an OAuth App access to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_unblocked", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "url", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rate_limited_invites", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recovery_code_failed", "description": "An organization owner failed to sign into a organization with an external identity provider (IdP) using a recovery code.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reason", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recovery_code_used", "description": "An organization owner successfully signed into an organization with an external identity provider (IdP) using a recovery code.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/accessing-your-organization-if-your-identity-provider-is-unavailable", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recovery_codes_downloaded", "description": "An organization owner downloaded the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recovery_codes_generated", "description": "An organization owner generated the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recovery_codes_printed", "description": "An organization owner printed the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recovery_codes_viewed", "description": "An organization owner viewed the organization's SSO recovery codes.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/downloading-your-organizations-saml-single-sign-on-recovery-codes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_actions_secret", "description": "A GitHub Actions secret was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_billing_manager", "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_integration_secret", "description": "An integration secret was removed from an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_outside_collaborator", "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rename", "description": "An organization was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_create", "description": "Triggered when a required workflow is created.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_delete", "description": "Triggered when a required workflow is deleted.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_update", "description": "Triggered when a required workflow is updated.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.restore_member", "description": "An organization member was restored.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.revoke_external_identity", "description": "A member's linked identity was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.revoke_sso_session", "description": "A member's SAML session was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_created", "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_removed", "description": "A self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_renamed", "description": "A self-hosted runner group was renamed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runner_removed", "description": "The REST API was used to remove a self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_added", "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_updated", "description": "A runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_updated", "description": "The configuration of a self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_visiblity_updated", "description": "The visibility of a self-hosted runner group was updated via the REST API.", - "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the organization level", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#allowing-validity-checks-for-partner-patterns-in-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_generic_secrets.disabled", "description": "Generic secrets have been disabled at the organization level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_generic_secrets.enabled", "description": "Generic secrets have been enabled at the organization level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_disabled", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_enabled", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_updated", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_disable", "description": "Push protection for secret scanning was disabled.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_enable", "description": "Push protection for secret scanning was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_disable", "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_enable", "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transfer", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transfer_outgoing", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.unarchive", "description": "The organization was unarchived.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.unblock_user", "description": "A user was unblocked from an organization.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_settings", "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_default_repository_permission", "description": "The default repository permission level for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_integration_secret", "description": "An integration secret was updated for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_new_repository_default_branch_setting", "description": "The name of the default branch was changed for new repositories in the organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_repo_self_hosted_runners_policy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_emu_repo_runners_policy", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_repo_runners_policy", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_emu_repo_runners_policy", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_repo_runners_policy", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_saml_provider_settings", "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_terms_of_service", "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", - "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" + "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.create", "description": "A default label was created for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.destroy", "description": "A default label was deleted for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.update", "description": "A default label was edited for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.approve", "description": "A domain was approved for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.create", "description": "A domain was added to an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.destroy", "description": "A domain was removed from an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.verify", "description": "A domain was verified for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.add_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.add_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.remove_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.remove_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.clear", "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.disable", "description": "Organization projects were disabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.enable", "description": "Organization projects were enabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_role.assign", "description": "An organization role was assigned to a user or team.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_role_id", + "organization_role_name", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_role.create", "description": "A custom organization role was created in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_role.destroy", "description": "A custom organization role was deleted in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_role.revoke", "description": "A user or team was unassigned an organization role.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_role_id", + "organization_role_name", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_role.update", "description": "A custom organization role was edited in an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_deleted", "description": "An entire package was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_published", "description": "A package was published or republished to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_deleted", "description": "A specific package version was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_published", "description": "A specific package version was published or republished to a package.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.create", "description": "A GitHub Codespaces prebuild configuration for a repository was created.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.destroy", "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.run_triggered", "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.update", "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.clear", "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.disable", "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.enable", "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.authorized_users_teams", "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.branch_allowances", "description": "A protected branch allowance was given to a specific user, team or integration.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "authorized_actors", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.create", "description": "Branch protection was enabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.destroy", "description": "Branch protection was disabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismiss_stale_reviews", "description": "Enforcement of dismissing stale pull requests was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismissal_restricted_users_teams", "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "authorized_actors", + "authorized_actors_only", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.policy_override", "description": "A branch protection requirement was overridden by a repository administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "after", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "before", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "compliant_pull_request_ids", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "overridden_codes", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reasons", + "referrer", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.rejected_ref_update", "description": "A branch update attempt was rejected.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_admin_enforced", "description": "Branch protection was enforced for repository administrators.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_deletions_enforcement_level", "description": "Branch deletion was enabled or disabled for a protected branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_force_pushes_enforcement_level", "description": "Force pushes were enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_ignore_approvals_from_contributors", "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_linear_history_requirement_enforcement_level", "description": "Required linear commit history was enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_allows_fetch_and_merge", "description": "Fork syncing was enabled or disabled for a read-only branch", - "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_branch_enforcement_level", "description": "The enforcement of a branch lock was updated.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_name", "description": "A branch name pattern was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_pull_request_reviews_enforcement_level", "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_code_owner_review", "description": "Enforcement of required code owner review was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_last_push_approval", "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_approving_review_count", "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_status_checks_enforcement_level", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_signature_requirement_enforcement_level", "description": "Enforcement of required commit signing was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_strict_required_status_checks_policy", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.close", "description": "A pull request was closed without being merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.converted_to_draft", "description": "A pull request was converted to a draft.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create", "description": "A pull request was created.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create_review_request", "description": "A review was requested on a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.in_progress", "description": "A pull request was marked as in progress.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.indirect_merge", "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.merge", "description": "A pull request was merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.ready_for_review", "description": "A pull request was marked as ready for review.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.rebase", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.remove_review_request", "description": "A review request was removed from a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.reopen", "description": "A pull request was reopened after previously being closed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.create", "description": "A review comment was added to a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.delete", "description": "A review comment on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.update", "description": "A review comment on a pull request was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.delete", "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.dismiss", "description": "A review on a pull request was dismissed.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.submit", "description": "A review on a pull request was submitted.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_disabled", "description": "Code scanning using the default setup was disabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_enabled", "description": "Code scanning using the default setup was enabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to this repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to this repository was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "request_category", + "request_method", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "request_category", + "request_method", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.download_zip", "description": "A source code archive of a repository was downloaded as a ZIP file.", - "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives" + "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_soft_delete", "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_soft_delete_restore", "description": "A GitHub Pages site that was previously soft-deleted was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename_branch", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "changes", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_branch", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_branch", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repo_was", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "changes", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_branch", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_branch", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.close", "description": "Someone closed a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.cve_request", "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.github_broadcast", "description": "GitHub made a security advisory public in the GitHub Advisory Database.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.github_withdraw", "description": "GitHub withdrew a security advisory that was published in error.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.open", "description": "Someone opened a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.publish", "description": "Someone published a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.reopen", "description": "Someone reopened as draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.update", "description": "Someone edited a draft or published security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_branch_protection_evaluation.disable", "description": "Branch protections were disabled for the repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_branch_protection_evaluation.enable", "description": "Branch protections were enabled for this repository.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_content_analysis.disable", "description": "Data use settings were disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_content_analysis.enable", "description": "Data use settings were enabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_dependency_graph.disable", "description": "The dependency graph was disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_dependency_graph.enable", "description": "The dependency graph was enabled for a private repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.clear", "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.disable", "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.enable", "description": "Repository projects were enabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.disabled", "description": "Automatic partner validation checks have been disabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_automatic_validity_checks.enabled", "description": "Automatic partner validation checks have been enabled at the repository level", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#allowing-validity-checks-for-partner-patterns-in-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.publish", "description": "A custom pattern was published for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.disable", "description": "Secret scanning was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.enable", "description": "Secret scanning was enabled for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_generic_secrets.disabled", "description": "Generic secrets have been disabled at the repository level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_generic_secrets.enabled", "description": "Generic secrets have been enabled at the repository level", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.disable", "description": "Secret scanning push protection was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.enable", "description": "Secret scanning push protection was enabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.clear", "description": "The repository visibility change setting was cleared for an organization or enterprise.", - "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility" + "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.disable", "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.enable", "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.auto_dismiss", "description": "A Dependabot alert was automatically dismissed because its metadata matches an enabled Dependabot rule.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.auto_reopen", "description": "A previously auto-dismissed Dependabot alert was automatically reopened because its metadata no longer matches an enabled Dependabot rule.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/using-alert-rules-to-prioritize-dependabot-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.create", "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.dismiss", "description": "A Dependabot alert was manually dismissed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.reintroduce", "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.reopen", "description": "A Dependabot alert was manually reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.resolve", "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.authorized_users_teams", "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts_auto_dismissal.disable", "description": "Automatic dismissal of low-impact Dependabot alerts was disabled for the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts_auto_dismissal.enable", "description": "Automatic dismissal of low-impact Dependabot alerts was enabled for the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.disable", "description": "Dependabot alerts was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.enable", "description": "Dependabot alerts was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "required_status_check.create", "description": "A status check was marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "context", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "required_status_check.destroy", "description": "A status check was no longer marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "context", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.disable", "description": "Email notification restrictions for an organization or enterprise were disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.enable", "description": "Email notification restrictions for an organization or enterprise were enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.create", "description": "A new custom repository role was created.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.destroy", "description": "A custom repository role was deleted.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.update", "description": "A custom repository role was edited.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.create", "description": "GitHub detected a secret and created a secret scanning alert.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.reopen", "description": "A seret scanning alert was reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.resolve", "description": "A seret scanning alert was resolved.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.revoke", "description": "A secret scanning alert was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.validate", "description": "A secret scanning alert was validated.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.disable", "description": "Secret scanning was disabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.enable", "description": "Secret scanning was enabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.disable", "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.enable", "description": "Secret scanning was enabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_push_protection.bypass", "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.invoiced_agreement_sign", "description": "An agreement for invoiced billing for GitHub Sponsors was signed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/paying-for-github-sponsors-by-invoice", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsors_patreon_user_create", "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "patreon_email", + "patreon_username", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsors_patreon_user_destroy", "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "patreon_email", + "patreon_username", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.create", "description": "An SSH certificate authority for an organization or enterprise was created.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.destroy", "description": "An SSH certificate authority for an organization or enterprise was deleted.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.disable", "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.enable", "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.dependabot_debug_credentials_generated", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.set_domain_token_expiration", "description": "The verification code expiry time for an organization or enterprise domain was set.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.unverify_domain", "description": "An organization or enterprise domain was unverified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.verify_domain", "description": "An organization or enterprise domain was verified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_member", "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_repository", "description": "A team was given access and permissions to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_parent_team", "description": "A child team was created or a child team's parent was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" + "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_privacy", "description": "A team's privacy level was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility" + "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.create", "description": "A new team is created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.demote_maintainer", "description": "A user was demoted from a team maintainer to a team member.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.destroy", "description": "A team was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.clear", "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.disable", "description": "Team discussions were disabled for an organization.", - "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization" + "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.enable", "description": "Team discussions were enabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.promote_maintainer", "description": "A user was promoted from a team member to a team maintainer.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_member", "description": "An organization member was removed from a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.rename", "description": "A team's name was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.disabled", "description": "Team synchronization with a tenant was disabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.enabled", "description": "Team synchronization with a tenant was enabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.update_okta_credentials", "description": "The Okta credentials for team synchronization with a tenant were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.create", "description": "A Dependabot rule was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "vulnerability_alert_rule_actions", + "vulnerability_alert_rule_conditions", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.delete", "description": "A Dependabot rule was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "vulnerability_alert_rule_actions", + "vulnerability_alert_rule_conditions", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.disable", "description": "A Dependabot rule was disabled for a single repository or disabled by default for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "vulnerability_alert_rule_actions", + "vulnerability_alert_rule_conditions", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.enable", "description": "A Dependabot rule was enabled for a single repository or enabled by default for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "vulnerability_alert_rule_actions", + "vulnerability_alert_rule_conditions", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.force_disable", "description": "A Dependabot rule was enabled for an organization and cannot be disabled for its repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "vulnerability_alert_rule_actions", + "vulnerability_alert_rule_conditions", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.force_enable", "description": "A Dependabot rule was disabled for an organization and cannot be enabled for its repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "vulnerability_alert_rule.update", "description": "A Dependabot rule's conditions, actions, or metadata changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "vulnerability_alert_rule_actions", + "vulnerability_alert_rule_conditions", + "vulnerability_alert_rule_id", + "vulnerability_alert_rule_name", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.cancel_workflow_run", "description": "A workflow run was cancelled.", - "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow" + "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.completed_workflow_run", "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history" + "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.created_workflow_run", "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow" + "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.prepared_workflow_job", "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows" + "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.rerun_workflow_run", "description": "A workflow run was re-run.", - "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs" + "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.13/user.json b/src/audit-logs/data/ghes-3.13/user.json index d39c9dadd90a..4a13cf450706 100644 --- a/src/audit-logs/data/ghes-3.13/user.json +++ b/src/audit-logs/data/ghes-3.13/user.json @@ -2,1851 +2,68085 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.confirm", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.recover", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.update_bill_cycle_day", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_fork_pr_approvals_policy", "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "devcontainer_path", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "machine_type", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "devcontainer_path", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "machine_type", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.start_environment", "description": "A codespace was started.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "devcontainer_path", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "machine_type", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "devcontainer_path", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "machine_type", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_added", "description": "A seat was added to the Copilot Business subscription for a user and they have received access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_created", "description": "A seat assignment was newly created for a user.", - "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business" + "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_refreshed", "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_reused", "description": "A seat assignment was re-created for a user who already had a seat with no pending cancellation date.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_assignment_unassigned", "description": "A seat was unassigned from a user and they will lose access to GitHub Copilot at the end of the billing cycle.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled", "description": "A seat was canceled from the Copilot Business subscription and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "copilot.cfb_seat_cancelled_by_staff", "description": "A seat was canceled from the Copilot Business subscription manually by GitHub and the user no longer has access to GitHub Copilot.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "current_value", + "custom_pattern", + "deploy_key_fingerprint", + "details", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "new_value", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "old_value", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "pending_cancellation_date", + "permission", + "previous_value", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "seat_assignment", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.create", "description": "An SSH key was added to a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.delete", "description": "An SSH key was removed from a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation" + "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation" + "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.publish", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.retire", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing_plan.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "bullets", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "description", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "has_free_trial", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "monthly_price_in_cents", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id", + "yearly_price_in_cents" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.create", "description": "An OAuth access token was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.destroy", "description": "An OAuth access token was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.regenerate", "description": "An OAuth access token was regenerated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_access.update", "description": "An OAuth access token was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.create", "description": "An authorization for an OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.destroy", "description": "An authorization for an OAuth application was deleted.", - "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations" + "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.register", "description": "A new passkey was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.remove", "description": "A new passkey was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.create", "description": "Triggered when you create a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_regenerated", "description": "Triggered when you regenerate a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_revoked", "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", - "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users" + "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.destroy", "description": "Triggered when you delete a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.update", "description": "A fine-grained personal access token was updated.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.configure_self_hosted_jit_runner", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "request_category", + "request_method", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "request_category", + "request_method", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_soft_delete", "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_soft_delete_restore", "description": "A GitHub Pages site that was previously soft-deleted was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limit", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.temporary_access_granted", "description": "Temporary access was enabled for a repository.", - "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repo_was", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "policy", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "changes", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_branch", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_branch", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "ruleset_bypass_actors", + "ruleset_bypass_actors_added", + "ruleset_bypass_actors_deleted", + "ruleset_bypass_actors_updated", + "ruleset_conditions", + "ruleset_conditions_added", + "ruleset_conditions_deleted", + "ruleset_conditions_updated", + "ruleset_enforcement", + "ruleset_id", + "ruleset_name", + "ruleset_old_enforcement", + "ruleset_old_name", + "ruleset_rules", + "ruleset_rules_added", + "ruleset_rules_deleted", + "ruleset_rules_updated", + "ruleset_source_type", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.register", "description": "A security key was registered for an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.remove", "description": "A security key was removed from an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_update_newsletter_send", "description": "Triggered when you send an email update to your sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsors_patreon_user_create", "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "patreon_email", + "patreon_username", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsors_patreon_user_destroy", "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "patreon_email", + "patreon_username", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.waitlist_join", "description": "You join the waitlist to join GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.accept", "description": "Triggered when you accept a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.cancel", "description": "Triggered when you cancel a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.create", "description": "Triggered when you create a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.decline", "description": "Triggered when you decline a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.revoke", "description": "Triggered when you revoke a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.register", "description": "A new trusted device was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.remove", "description": "A trusted device was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.abort", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.complete", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.ignore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_approve", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_decline", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.start", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.two_factor_destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.add_factor", "description": "A secondary authentication factor was added to a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.disabled", "description": "Two-factor authentication was disabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.enabled", "description": "Two-factor authentication was enabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.password_reset_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.recovery_codes_regenerated", "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.remove_factor", "description": "A secondary authentication factor was removed from a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.sign_in_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.update_fallback", "description": "The two-factor authentication fallback for a user account was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.add_email", "description": "An email address was added to a user account.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.async_delete", "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.audit_log_export", "description": "Audit log entries were exported.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "query_phrase", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.block_user", "description": "A user was blocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.change_password", "description": "A user changed their password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_granted", "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_revoked", "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create", "description": "A new user account was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create_integration_secret", "description": "A user secret for Codespaces was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.creation_rate_limit_exceeded", "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.delete", "description": "A user account was destroyed by an asynchronous job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.demote", "description": "A site administrator was demoted to an ordinary user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.destroy", "description": "A user deleted his or her account, triggering user.async_delete.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_failure", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_requested", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_success", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.failed_login", "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.forgot_password", "description": "A user requested a password reset.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.grant_github_developer", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.hide_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.login", "description": "A user signed in.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.logout", "description": "A user signed out.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.new_device_used", "description": "A user signed in from a new device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.promote", "description": "An ordinary user account was promoted to a site administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.recreate", "description": "A user's account was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_email", "description": "An email address was removed from a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "email", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_integration_secret", "description": "A user secret for Codespaces was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.rename", "description": "A username was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.reset_password", "description": "A user reset their account password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_session.country_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.show_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device", "description": "A user signed in from an unrecognized device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device_and_location", "description": "A user signed in from an unrecognized device and location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.destroy", "description": "Triggered when you clear the status on your profile.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.update", "description": "Triggered when you set or change the status on your profile.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.suspend", "description": "A user account was suspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.toggle_warn_private_email", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_failure", "description": "A 2FA challenge issued for a user account failed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_success", "description": "A 2FA challenge issued for a user account succeeded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recover", "description": "A user used their 2FA recovery codes.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_downloaded", "description": "A user downloaded 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_printed", "description": "A user printed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_viewed", "description": "A user viewed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_requested", "description": "A user was prompted for a two-factor authentication code.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unblock_user", "description": "A user was unblocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unsuspend", "description": "A user account was unsuspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_integration_secret", "description": "A user secret for Codespaces was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_new_repository_default_branch_setting", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "actor_is_bot", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "marketplace_listing", + "marketplace_listing_plan", + "merge_queue_enforcement_level", + "message", + "name", + "new_policy", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_policy", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "primary_category", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secondary_category", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "updated_access_policy", + "updated_allowed_types", + "updated_github_owned_allowed", + "updated_patterns", + "updated_verified_allowed", + "user", + "user", + "user_agent", + "user_id", + "user_programmatic_access_name", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.8/enterprise.json b/src/audit-logs/data/ghes-3.8/enterprise.json index b0455180be78..9375c88e898e 100644 --- a/src/audit-logs/data/ghes-3.8/enterprise.json +++ b/src/audit-logs/data/ghes-3.8/enterprise.json @@ -2,2911 +2,88072 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.confirm", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.recover", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.update_bill_cycle_day", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.add_admin", "description": "An enterprise owner was added to an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.add_organization", "description": "An organization was added to an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.disabled", "description": "GitHub Advanced Security was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.enabled", "description": "GitHub Advanced Security was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.advanced_security_policy_update", "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.advanced_security_repo_admin_enablement_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_actions_settings", "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_default_repository_permission", "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_members_can_create_repos", "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.create", "description": "An enterprise was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.dependabot_alerts_repo_admin_enablement_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.disable_two_factor_requirement", "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.enable_two_factor_requirement", "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.clear", "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.remove_admin", "description": "An enterprise owner was removed from an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.remove_organization", "description": "An organization was removed from an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.rename_slug", "description": "The slug for the enterprise URL was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.create", "description": "An enterprise-level custom pattern was created for secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.delete", "description": "An enterprise-level custom pattern was removed from secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.update", "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.disable", "description": "Secret scanning was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.disabled_for_new_repos", "description": "Secret scanning was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.enable", "description": "Secret scanning was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.enabled_for_new_repos", "description": "Secret scanning was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.disable", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.enable", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.update", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.disable", "description": "Push protection for secret scanning was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.disabled_for_new_repos", "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.enable", "description": "Push protection for secret scanning was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.enabled_for_new_repos", "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.secret_scanning_repo_admin_settings_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_fork_pr_approvals_policy", "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_actions_settings", "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_default_repository_permission", "description": "The base repository permission setting was updated for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_member_repository_creation_permission", "description": "The repository creation setting was updated for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_member_repository_invitation_permission", "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.destroy", "description": "Triggered when a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.destroy", "description": "Triggered when a reply to a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.update", "description": "Triggered when a reply to a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.update", "description": "Triggered when a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.create", "description": "A global announcement banner was created for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.destroy", "description": "A global announcement banner was removed from the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.update", "description": "A global announcement banner was updated for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.approve", "description": "A domain was approved for an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.create", "description": "A domain was added to an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.destroy", "description": "A domain was removed from an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.verify", "description": "A domain was verified for an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.register_self_hosted_runner", "description": "A new GitHub Actions self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.remove_self_hosted_runner", "description": "A GitHub Actions self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_created", "description": "A GitHub Actions self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_removed", "description": "A GitHub Actions self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runner_removed", "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runners_added", "description": "A GitHub Actions self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runners_updated", "description": "A GitHub Actions runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_updated", "description": "The configuration of a GitHub Actions self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_offline", "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_online", "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_updated", "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git.clone", "description": "A repository was cloned.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "business", + "hashed_token", + "org", + "programmatic_access_type", + "repo", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user" + ] }, { "action": "git.fetch", "description": "Changes were fetched from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "business", + "hashed_token", + "org", + "programmatic_access_type", + "repo", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user" + ] }, { "action": "git.push", "description": "Changes were pushed to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "business", + "hashed_token", + "org", + "programmatic_access_type", + "repo", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user" + ] }, { "action": "git_signing_ssh_public_key.create", "description": "An SSH key was added to a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.delete", "description": "An SSH key was removed from a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable", "description": "An IP allow list was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_for_installed_apps", "description": "An IP allow list was disabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_user_level_enforcement", "description": "IP allow list user level enforcement was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable", "description": "An IP allow list was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_for_installed_apps", "description": "An IP allow list was enabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_user_level_enforcement", "description": "IP allow list user level enforcement was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.create", "description": "An IP address was added to an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.destroy", "description": "An IP address was deleted from an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.update", "description": "An IP address or its description was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.publish", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.retire", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.suspend", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.unsuspend", "description": "An OAuth application was unsuspended for a user or organization account.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.create", "description": "An authorization for an OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.destroy", "description": "An authorization for an OAuth application was deleted.", - "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations" + "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.update", "description": "An authorization for an OAuth application was updated.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.accept_business_invitation", "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_billing_manager", "description": "A billing manager was added to an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_disabled", "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_enabled", "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.async_delete", "description": "A user initiated a background job to delete an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.audit_log_export", "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.billing_signup_error", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.block_user", "description": "An organization owner blocked a user from accessing the organization's repositories.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_business_invitation", "description": "An invitation for an organization to join an enterprise was revoked", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_invitation", "description": "An invitation sent to a user to join an organization was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.clear_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.confirm_business_invitation", "description": "An invitation for an organization to join an enterprise was confirmed.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create", "description": "An organization was created.", - "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" + "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.delete", "description": "An organization was deleted by a user-initiated background job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_member_team_creation_permission", "description": "Team creation was limited to owners.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_reader_discussion_creation_permission", "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_saml", "description": "SAML single sign-on was disabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_two_factor_requirement", "description": "A two-factor authentication requirement was disabled for the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_disabled", "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_enabled", "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_member_team_creation_permission", "description": "Team creation by members was allowed.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_reader_discussion_creation_permission", "description": "An organization owner allowed users with read access to create discussions in an organization", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_saml", "description": "SAML single sign-on was enabled for the organization.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_two_factor_requirement", "description": "Two-factor authentication is now required for the organization.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_added", "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_removed", "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_member", "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_to_business", "description": "An organization was invited to join an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rate_limited_invites", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recreate", "description": "An organization was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_billing_manager", "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_outside_collaborator", "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rename", "description": "An organization was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.restore_member", "description": "An organization member was restored.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_created", "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_removed", "description": "A self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runner_removed", "description": "The REST API was used to remove a self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_added", "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_updated", "description": "A runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_updated", "description": "The configuration of a self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_disabled", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_enabled", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_updated", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_disable", "description": "Push protection for secret scanning was disabled.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_enable", "description": "Push protection for secret scanning was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_disable", "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_enable", "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transform", "description": "A user account was converted into an organization.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.unblock_user", "description": "A user was unblocked from an organization.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_settings", "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_default_repository_permission", "description": "The default repository permission level for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_saml_provider_settings", "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_terms_of_service", "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", - "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" + "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.approve", "description": "A domain was approved for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.create", "description": "A domain was added to an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.destroy", "description": "A domain was removed from an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.verify", "description": "A domain was verified for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_deleted", "description": "An entire package was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_published", "description": "A package was published or republished to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_deleted", "description": "A specific package version was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_published", "description": "A specific package version was published or republished to a package.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.create", "description": "Triggered when you create a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_regenerated", "description": "Triggered when you regenerate a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_revoked", "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", - "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users" + "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.destroy", "description": "Triggered when you delete a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.update", "description": "A fine-grained personal access token was updated.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.authorized_users_teams", "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.create", "description": "Branch protection was enabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.destroy", "description": "Branch protection was disabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismiss_stale_reviews", "description": "Enforcement of dismissing stale pull requests was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismissal_restricted_users_teams", "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.policy_override", "description": "A branch protection requirement was overridden by a repository administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "after", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "before", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "compliant_pull_request_ids", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "overridden_codes", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reasons", + "referrer", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.rejected_ref_update", "description": "A branch update attempt was rejected.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_admin_enforced", "description": "Branch protection was enforced for repository administrators.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_deletions_enforcement_level", "description": "Branch deletion was enabled or disabled for a protected branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_force_pushes_enforcement_level", "description": "Force pushes were enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_ignore_approvals_from_contributors", "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_linear_history_requirement_enforcement_level", "description": "Required linear commit history was enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_allows_fetch_and_merge", "description": "Fork syncing was enabled or disabled for a read-only branch", - "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_branch_enforcement_level", "description": "The enforcement of a branch lock was updated.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_name", "description": "A branch name pattern was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_pull_request_reviews_enforcement_level", "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_code_owner_review", "description": "Enforcement of required code owner review was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_last_push_approval", "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_approving_review_count", "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_status_checks_enforcement_level", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_signature_requirement_enforcement_level", "description": "Enforcement of required commit signing was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_strict_required_status_checks_policy", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.close", "description": "A pull request was closed without being merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.converted_to_draft", "description": "A pull request was converted to a draft.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create", "description": "A pull request was created.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create_review_request", "description": "A review was requested on a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.in_progress", "description": "A pull request was marked as in progress.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.indirect_merge", "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.merge", "description": "A pull request was merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.ready_for_review", "description": "A pull request was marked as ready for review.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.rebase", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.remove_review_request", "description": "A review request was removed from a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.reopen", "description": "A pull request was reopened after previously being closed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.create", "description": "A review comment was added to a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.delete", "description": "A review comment on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.update", "description": "A review comment on a pull request was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.delete", "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.dismiss", "description": "A review on a pull request was dismissed.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.submit", "description": "A review on a pull request was submitted.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.auto_codeql_disabled", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.auto_codeql_enabled", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.disk_archive", "description": "A repository was archived on disk.", - "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories" + "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.download_zip", "description": "A source code archive of a repository was downloaded as a ZIP file.", - "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives" + "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.hide_from_discovery", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.noindex", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.override_unlock", "description": "The repository was unlocked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_build", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.require_login", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.disable", "description": "Secret scanning was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.enable", "description": "Secret scanning was enabled for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.disable", "description": "Secret scanning push protection was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.enable", "description": "Secret scanning push protection was enabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.disable", "description": "Email notification restrictions for an organization or enterprise were disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.enable", "description": "Email notification restrictions for an organization or enterprise were enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.create", "description": "GitHub detected a secret and created a secret scanning alert.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.reopen", "description": "A seret scanning alert was reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.resolve", "description": "A seret scanning alert was resolved.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.revoke", "description": "A secret scanning alert was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.disable", "description": "Secret scanning was disabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.enable", "description": "Secret scanning was enabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.disable", "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.enable", "description": "Secret scanning was enabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_push_protection.bypass", "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.register", "description": "A security key was registered for an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.remove", "description": "A security key was removed from an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_update_newsletter_send", "description": "Triggered when you send an email update to your sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.waitlist_join", "description": "You join the waitlist to join GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.create", "description": "An SSH certificate authority for an organization or enterprise was created.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.destroy", "description": "An SSH certificate authority for an organization or enterprise was deleted.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.disable", "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.enable", "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.set_domain_token_expiration", "description": "The verification code expiry time for an organization or enterprise domain was set.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.unverify_domain", "description": "An organization or enterprise domain was unverified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.verify_domain", "description": "An organization or enterprise domain was verified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.accept", "description": "Triggered when you accept a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.cancel", "description": "Triggered when you cancel a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.create", "description": "Triggered when you create a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.decline", "description": "Triggered when you decline a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.revoke", "description": "Triggered when you revoke a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_member", "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_repository", "description": "A team was given access and permissions to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_parent_team", "description": "A child team was created or a child team's parent was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" + "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_privacy", "description": "A team's privacy level was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility" + "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.create", "description": "A new team is created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.demote_maintainer", "description": "A user was demoted from a team maintainer to a team member.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.destroy", "description": "A team was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.clear", "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.disable", "description": "Team discussions were disabled for an organization.", - "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization" + "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.enable", "description": "Team discussions were enabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.promote_maintainer", "description": "A user was promoted from a team member to a team maintainer.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_member", "description": "An organization member was removed from a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.rename", "description": "A team's name was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.disabled", "description": "Team synchronization with a tenant was disabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.enabled", "description": "Team synchronization with a tenant was enabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.register", "description": "A new trusted device was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.remove", "description": "A trusted device was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.abort", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.complete", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.ignore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_approve", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_decline", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.start", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.two_factor_destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.disabled", "description": "Two-factor authentication was disabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.enabled", "description": "Two-factor authentication was enabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.password_reset_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.recovery_codes_regenerated", "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.sign_in_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.update_fallback", "description": "The two-factor authentication fallback for a user account was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.add_email", "description": "An email address was added to a user account.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.async_delete", "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.audit_log_export", "description": "Audit log entries were exported.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.block_user", "description": "A user was blocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.change_password", "description": "A user changed their password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_granted", "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_revoked", "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_device", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_device_and_location", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_location", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create", "description": "A new user account was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.creation_rate_limit_exceeded", "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.delete", "description": "A user account was destroyed by an asynchronous job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.demote", "description": "A site administrator was demoted to an ordinary user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.destroy", "description": "A user deleted his or her account, triggering user.async_delete.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_failure", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_requested", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_success", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.failed_login", "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.flag_as_large_scale_contributor", "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.forgot_password", "description": "A user requested a password reset.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.grant_github_developer", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.hide_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.login", "description": "A user signed in.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.minimize_comment", "description": "A comment made by a user was minimized.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.partial_two_factor_email_followup", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.promote", "description": "An ordinary user account was promoted to a site administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.recreate", "description": "A user's account was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_email", "description": "An email address was removed from a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_large_scale_contributor_flag", "description": "A user account was no longer flagged as a large scale contributor.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.rename", "description": "A username was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.report_abuse", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.report_content", "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.reset_password", "description": "A user reset their account password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_session.country_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.show_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device", "description": "A user signed in from an unrecognized device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device_and_location", "description": "A user signed in from an unrecognized device and location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_location", "description": "A user signed in from an unrecognized location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.destroy", "description": "Triggered when you clear the status on your profile.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.update", "description": "Triggered when you set or change the status on your profile.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.suspend", "description": "A user account was suspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.toggle_warn_private_email", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_failure", "description": "A 2FA challenge issued for a user account failed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_success", "description": "A 2FA challenge issued for a user account succeeded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recover", "description": "A user used their 2FA recovery codes.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_downloaded", "description": "A user downloaded 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_printed", "description": "A user printed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_viewed", "description": "A user viewed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_requested", "description": "A user was prompted for a two-factor authentication code.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unblock_user", "description": "A user was unblocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unminimize_comment", "description": "A comment made by a user was unminimized.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unsuspend", "description": "A user account was unsuspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_new_repository_default_branch_setting", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.cancel_workflow_run", "description": "A workflow run was cancelled.", - "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow" + "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.completed_workflow_run", "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history" + "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.created_workflow_run", "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow" + "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.prepared_workflow_job", "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows" + "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.rerun_workflow_run", "description": "A workflow run was re-run.", - "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs" + "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.8/organization.json b/src/audit-logs/data/ghes-3.8/organization.json index 1bf108d1819c..65b14e0e23e1 100644 --- a/src/audit-logs/data/ghes-3.8/organization.json +++ b/src/audit-logs/data/ghes-3.8/organization.json @@ -2,2651 +2,80171 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.accept", "description": "Credit was accepted for a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.create", "description": "Someone was added to the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.decline", "description": "Credit was declined for a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.destroy", "description": "Someone was removed from the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "auto_approve_personal_access_token_requests.disable", "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "auto_approve_personal_access_token_requests.enable", "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.attempted_to_create_from_prebuild", "description": "An attempt to create a codespace from a prebuild was made.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_created", "description": "Policies were applied to codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_deleted", "description": "Policies were removed from codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_updated", "description": "Policies were updated for codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "commit_comment.destroy", "description": "A commit comment was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "commit_comment.update", "description": "A commit comment was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_comment.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_comment.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.destroy", "description": "Triggered when a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.destroy", "description": "Triggered when a reply to a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.update", "description": "Triggered when a reply to a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.update", "description": "Triggered when a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_installation.create", "description": "The GitHub App associated with a GitHub Connect connection was created.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_installation.destroy", "description": "The GitHub App associated with a GitHub Connect connection was deleted.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git.clone", "description": "A repository was cloned.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "business", + "hashed_token", + "org", + "programmatic_access_type", + "repo", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user" + ] }, { "action": "git.fetch", "description": "Changes were fetched from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "business", + "hashed_token", + "org", + "programmatic_access_type", + "repo", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user" + ] }, { "action": "git.push", "description": "Changes were pushed to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "business", + "hashed_token", + "org", + "programmatic_access_type", + "repo", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation_request.close", "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation_request.create", "description": "A member requested that an owner install a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable", "description": "An IP allow list was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_for_installed_apps", "description": "An IP allow list was disabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable", "description": "An IP allow list was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_for_installed_apps", "description": "An IP allow list was enabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.create", "description": "An IP address was added to an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.destroy", "description": "An IP address was deleted from an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.update", "description": "An IP address or its description was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue_comment.destroy", "description": "A comment on an issue was deleted from the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.destroy", "description": "An issue was deleted from the repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue" + "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.pinned", "description": "An issue was pinned to a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.transfer", "description": "An issue was transferred to another repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.unpinned", "description": "An issue was unpinned from a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_disabled", "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_enabled", "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_policy_cleared", "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_pages.disable", "description": "The ability for members to publish GitHub Pages sites was disabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_pages.enable", "description": "The ability for members to publish GitHub Pages sites was enabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_private_pages.disable", "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_private_pages.enable", "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_public_pages.disable", "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_public_pages.enable", "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.clear", "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.disable", "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.enable", "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.clear", "description": "An enterprise owner cleared the policy setting for viewing dependency insights in any organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.disable", "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.enable", "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.destroy_file", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.download", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.accept_business_invitation", "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_billing_manager", "description": "A billing manager was added to an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_disabled", "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_enabled", "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.allow_third_party_access_requests_from_outside_collaborators_disabled", "description": "Third-party application access for outside collaborators was disabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled", "description": "Third-party application access for outside collaborators was enabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.audit_log_export", "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.audit_log_git_event_export", "description": "An export of the organization's Git events was created.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.billing_signup_error", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.block_user", "description": "An organization owner blocked a user from accessing the organization's repositories.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_business_invitation", "description": "An invitation for an organization to join an enterprise was revoked", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_invitation", "description": "An invitation sent to a user to join an organization was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.clear_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.confirm_business_invitation", "description": "An invitation for an organization to join an enterprise was confirmed.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.connect_usage_metrics_export", "description": "Server statistics were exported for the organization.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create", "description": "An organization was created.", - "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" + "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_actions_secret", "description": "A GitHub Actions secret was created for an organization.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_integration_secret", "description": "An integration secret was created for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.deauthorize", "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.grant", "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.revoke", "description": "An owner revoked authorized credentials.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_member_team_creation_permission", "description": "Team creation was limited to owners.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were disabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_reader_discussion_creation_permission", "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_saml", "description": "SAML single sign-on was disabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_two_factor_requirement", "description": "A two-factor authentication requirement was disabled for the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_disabled", "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_enabled", "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_member_team_creation_permission", "description": "Team creation by members was allowed.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were enabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_reader_discussion_creation_permission", "description": "An organization owner allowed users with read access to create discussions in an organization", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_saml", "description": "SAML single sign-on was enabled for the organization.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_two_factor_requirement", "description": "Two-factor authentication is now required for the organization.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_added", "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_removed", "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_member", "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_to_business", "description": "An organization was invited to join an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_approved", "description": "Access to an organization was granted for an OAuth App.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_denied", "description": "Access was disabled for an OAuth App that was previously approved.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_requested", "description": "An organization member requested that an owner grant an OAuth App access to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rate_limited_invites", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_actions_secret", "description": "A GitHub Actions secret was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_billing_manager", "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_integration_secret", "description": "An integration secret was removed from an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_outside_collaborator", "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rename", "description": "An organization was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_create", "description": "Triggered when a required workflow is created.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_delete", "description": "Triggered when a required workflow is deleted.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_update", "description": "Triggered when a required workflow is updated.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.restore_member", "description": "An organization member was restored.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.revoke_external_identity", "description": "A member's linked identity was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.revoke_sso_session", "description": "A member's SAML session was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_created", "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_removed", "description": "A self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_renamed", "description": "A self-hosted runner group was renamed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runner_removed", "description": "The REST API was used to remove a self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_added", "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_updated", "description": "A runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_updated", "description": "The configuration of a self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_visiblity_updated", "description": "The visibility of a self-hosted runner group was updated via the REST API.", - "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_disabled", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_enabled", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_updated", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_disable", "description": "Push protection for secret scanning was disabled.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_enable", "description": "Push protection for secret scanning was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_disable", "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_enable", "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transfer", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transfer_outgoing", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.unblock_user", "description": "A user was unblocked from an organization.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_settings", "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_default_repository_permission", "description": "The default repository permission level for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_integration_secret", "description": "An integration secret was updated for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_new_repository_default_branch_setting", "description": "The name of the default branch was changed for new repositories in the organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_saml_provider_settings", "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_terms_of_service", "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", - "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" + "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.create", "description": "A default label was created for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.destroy", "description": "A default label was deleted for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.update", "description": "A default label was edited for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.approve", "description": "A domain was approved for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.create", "description": "A domain was added to an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.destroy", "description": "A domain was removed from an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.verify", "description": "A domain was verified for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.add_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.add_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.remove_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.remove_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.clear", "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.disable", "description": "Organization projects were disabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.enable", "description": "Organization projects were enabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_deleted", "description": "An entire package was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_published", "description": "A package was published or republished to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_deleted", "description": "A specific package version was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_published", "description": "A specific package version was published or republished to a package.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.create", "description": "A GitHub Codespaces prebuild configuration for a repository was created.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.destroy", "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.run_triggered", "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.update", "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.clear", "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.disable", "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.enable", "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.authorized_users_teams", "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.create", "description": "Branch protection was enabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.destroy", "description": "Branch protection was disabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismiss_stale_reviews", "description": "Enforcement of dismissing stale pull requests was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismissal_restricted_users_teams", "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.policy_override", "description": "A branch protection requirement was overridden by a repository administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "after", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "before", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "compliant_pull_request_ids", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "overridden_codes", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reasons", + "referrer", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.rejected_ref_update", "description": "A branch update attempt was rejected.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_admin_enforced", "description": "Branch protection was enforced for repository administrators.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_deletions_enforcement_level", "description": "Branch deletion was enabled or disabled for a protected branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_force_pushes_enforcement_level", "description": "Force pushes were enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_ignore_approvals_from_contributors", "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_linear_history_requirement_enforcement_level", "description": "Required linear commit history was enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_allows_fetch_and_merge", "description": "Fork syncing was enabled or disabled for a read-only branch", - "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_branch_enforcement_level", "description": "The enforcement of a branch lock was updated.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_name", "description": "A branch name pattern was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_pull_request_reviews_enforcement_level", "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_code_owner_review", "description": "Enforcement of required code owner review was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_last_push_approval", "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_approving_review_count", "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_status_checks_enforcement_level", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_signature_requirement_enforcement_level", "description": "Enforcement of required commit signing was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_strict_required_status_checks_policy", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.close", "description": "A pull request was closed without being merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.converted_to_draft", "description": "A pull request was converted to a draft.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create", "description": "A pull request was created.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create_review_request", "description": "A review was requested on a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.in_progress", "description": "A pull request was marked as in progress.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.indirect_merge", "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.merge", "description": "A pull request was merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.ready_for_review", "description": "A pull request was marked as ready for review.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.rebase", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.remove_review_request", "description": "A review request was removed from a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.reopen", "description": "A pull request was reopened after previously being closed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.create", "description": "A review comment was added to a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.delete", "description": "A review comment on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.update", "description": "A review comment on a pull request was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.delete", "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.dismiss", "description": "A review on a pull request was dismissed.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.submit", "description": "A review on a pull request was submitted.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.auto_codeql_disabled", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.auto_codeql_enabled", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to this repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to this repository was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.download_zip", "description": "A source code archive of a repository was downloaded as a ZIP file.", - "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives" + "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename_branch", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.close", "description": "Someone closed a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.cve_request", "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.github_broadcast", "description": "GitHub made a security advisory public in the GitHub Advisory Database.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.github_withdraw", "description": "GitHub withdrew a security advisory that was published in error.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.open", "description": "Someone opened a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.publish", "description": "Someone published a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.reopen", "description": "Someone reopened as draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.update", "description": "Someone edited a draft or published security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_content_analysis.disable", "description": "Data use settings were disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_content_analysis.enable", "description": "Data use settings were enabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_dependency_graph.disable", "description": "The dependency graph was disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_dependency_graph.enable", "description": "The dependency graph was enabled for a private repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.clear", "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.disable", "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.enable", "description": "Repository projects were enabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.disable", "description": "Secret scanning was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.enable", "description": "Secret scanning was enabled for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.disable", "description": "Secret scanning push protection was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.enable", "description": "Secret scanning push protection was enabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.clear", "description": "The repository visibility change setting was cleared for an organization or enterprise.", - "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility" + "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.disable", "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.enable", "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.create", "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.dismiss", "description": "A Dependabot alert was manually dismissed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.reintroduce", "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.reopen", "description": "A Dependabot alert was manually reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.resolve", "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.authorized_users_teams", "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.disable", "description": "Dependabot alerts was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.enable", "description": "Dependabot alerts was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "required_status_check.create", "description": "A status check was marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "required_status_check.destroy", "description": "A status check was no longer marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.disable", "description": "Email notification restrictions for an organization or enterprise were disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.enable", "description": "Email notification restrictions for an organization or enterprise were enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.create", "description": "A new custom repository role was created.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.destroy", "description": "A custom repository role was deleted.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.update", "description": "A custom repository role was edited.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.create", "description": "GitHub detected a secret and created a secret scanning alert.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.reopen", "description": "A seret scanning alert was reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.resolve", "description": "A seret scanning alert was resolved.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.revoke", "description": "A secret scanning alert was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.disable", "description": "Secret scanning was disabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.enable", "description": "Secret scanning was enabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.disable", "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.enable", "description": "Secret scanning was enabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_push_protection.bypass", "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.create", "description": "An SSH certificate authority for an organization or enterprise was created.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.destroy", "description": "An SSH certificate authority for an organization or enterprise was deleted.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.disable", "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.enable", "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.dependabot_debug_credentials_generated", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.set_domain_token_expiration", "description": "The verification code expiry time for an organization or enterprise domain was set.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.unverify_domain", "description": "An organization or enterprise domain was unverified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.verify_domain", "description": "An organization or enterprise domain was verified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_member", "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_repository", "description": "A team was given access and permissions to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_parent_team", "description": "A child team was created or a child team's parent was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" + "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_privacy", "description": "A team's privacy level was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility" + "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.create", "description": "A new team is created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.demote_maintainer", "description": "A user was demoted from a team maintainer to a team member.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.destroy", "description": "A team was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.clear", "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.disable", "description": "Team discussions were disabled for an organization.", - "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization" + "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.enable", "description": "Team discussions were enabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.promote_maintainer", "description": "A user was promoted from a team member to a team maintainer.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_member", "description": "An organization member was removed from a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.rename", "description": "A team's name was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.disabled", "description": "Team synchronization with a tenant was disabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.enabled", "description": "Team synchronization with a tenant was enabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.update_okta_credentials", "description": "The Okta credentials for team synchronization with a tenant were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.cancel_workflow_run", "description": "A workflow run was cancelled.", - "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow" + "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.completed_workflow_run", "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history" + "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.created_workflow_run", "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow" + "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.prepared_workflow_job", "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows" + "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.rerun_workflow_run", "description": "A workflow run was re-run.", - "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs" + "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.8/user.json b/src/audit-logs/data/ghes-3.8/user.json index 7f06487b67b3..fbe109f3adf1 100644 --- a/src/audit-logs/data/ghes-3.8/user.json +++ b/src/audit-logs/data/ghes-3.8/user.json @@ -2,1556 +2,47273 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.confirm", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.recover", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.update_bill_cycle_day", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_fork_pr_approvals_policy", "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.create", "description": "An SSH key was added to a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.delete", "description": "An SSH key was removed from a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.publish", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.retire", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.create", "description": "An authorization for an OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.destroy", "description": "An authorization for an OAuth application was deleted.", - "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations" + "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.create", "description": "Triggered when you create a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_regenerated", "description": "Triggered when you regenerate a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_revoked", "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", - "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users" + "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.destroy", "description": "Triggered when you delete a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.update", "description": "A fine-grained personal access token was updated.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.register", "description": "A security key was registered for an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.remove", "description": "A security key was removed from an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_update_newsletter_send", "description": "Triggered when you send an email update to your sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.waitlist_join", "description": "You join the waitlist to join GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.accept", "description": "Triggered when you accept a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.cancel", "description": "Triggered when you cancel a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.create", "description": "Triggered when you create a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.decline", "description": "Triggered when you decline a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.revoke", "description": "Triggered when you revoke a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.register", "description": "A new trusted device was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.remove", "description": "A trusted device was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.abort", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.complete", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.ignore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_approve", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_decline", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.start", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.two_factor_destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.disabled", "description": "Two-factor authentication was disabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.enabled", "description": "Two-factor authentication was enabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.password_reset_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.recovery_codes_regenerated", "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.sign_in_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.update_fallback", "description": "The two-factor authentication fallback for a user account was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.add_email", "description": "An email address was added to a user account.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.async_delete", "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.audit_log_export", "description": "Audit log entries were exported.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.block_user", "description": "A user was blocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.change_password", "description": "A user changed their password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_granted", "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_revoked", "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create", "description": "A new user account was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.creation_rate_limit_exceeded", "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.delete", "description": "A user account was destroyed by an asynchronous job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.demote", "description": "A site administrator was demoted to an ordinary user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.destroy", "description": "A user deleted his or her account, triggering user.async_delete.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_failure", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_requested", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_success", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.failed_login", "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.forgot_password", "description": "A user requested a password reset.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.grant_github_developer", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.hide_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.login", "description": "A user signed in.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.promote", "description": "An ordinary user account was promoted to a site administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.recreate", "description": "A user's account was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_email", "description": "An email address was removed from a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.rename", "description": "A username was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.reset_password", "description": "A user reset their account password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_session.country_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.show_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.destroy", "description": "Triggered when you clear the status on your profile.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.update", "description": "Triggered when you set or change the status on your profile.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.suspend", "description": "A user account was suspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.toggle_warn_private_email", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_failure", "description": "A 2FA challenge issued for a user account failed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_success", "description": "A 2FA challenge issued for a user account succeeded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recover", "description": "A user used their 2FA recovery codes.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_downloaded", "description": "A user downloaded 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_printed", "description": "A user printed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_viewed", "description": "A user viewed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_requested", "description": "A user was prompted for a two-factor authentication code.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unblock_user", "description": "A user was unblocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unsuspend", "description": "A user account was unsuspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_new_repository_default_branch_setting", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "invitee_email", + "is_hosted_runner", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "signature_requirement_enforcement_level", + "source_version", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "to_business", + "token_id", + "token_scopes", + "topic", + "trigger_id", + "user", + "user", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.9/enterprise.json b/src/audit-logs/data/ghes-3.9/enterprise.json index ccb5121d0899..57a3811231ce 100644 --- a/src/audit-logs/data/ghes-3.9/enterprise.json +++ b/src/audit-logs/data/ghes-3.9/enterprise.json @@ -2,3146 +2,106974 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.confirm", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.recover", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "api.request", "description": "An API request was made to a security-significant endpoint for the enterprise. This event is only included if API Request Events is enabled in the enterprise's audit log settings. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-audit-log-streaming-of-api-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "application_name", + "business", + "business_id", + "hashed_token", + "integration", + "org", + "org_id", + "programmatic_access_type", + "query_string", + "rate_limit_remaining", + "repo", + "repo_id", + "request_body", + "request_method", + "route", + "status_code", + "token_id", + "token_scopes", + "user", + "user_agent", + "user_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.update_bill_cycle_day", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.add_admin", "description": "An enterprise owner was added to an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.add_organization", "description": "An organization was added to an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.disabled", "description": "GitHub Advanced Security was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.enabled", "description": "GitHub Advanced Security was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_advanced_security.enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.advanced_security_policy_update", "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.advanced_security_repo_admin_enablement_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_actions_settings", "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_default_repository_permission", "description": "An enterprise owner cleared the base repository permission policy setting for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.clear_members_can_create_repos", "description": "An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.create", "description": "An enterprise was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for new repositories in your enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for new repositories in your enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.dependabot_alerts_repo_admin_enablement_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.disable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the enterprise was disabled.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.disable_two_factor_requirement", "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.enable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the enterprise was enabled.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.enable_two_factor_requirement", "description": "The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.clear", "description": "An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.remove_admin", "description": "An enterprise owner was removed from an enterprise.", - "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise" + "docs_reference_links": "/admin/user-management/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.remove_organization", "description": "An organization was removed from an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.rename_slug", "description": "The slug for the enterprise URL was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.create", "description": "An enterprise-level custom pattern was created for secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.delete", "description": "An enterprise-level custom pattern was removed from secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your enterprise.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your enterprise.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_custom_pattern.update", "description": "Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.disable", "description": "Secret scanning was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.disabled_for_new_repos", "description": "Secret scanning was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.enable", "description": "Secret scanning was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning.enabled_for_new_repos", "description": "Secret scanning was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.disable", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.enable", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection_custom_message.update", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.disable", "description": "Push protection for secret scanning was disabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.disabled_for_new_repos", "description": "Push protection for secret scanning was disabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.enable", "description": "Push protection for secret scanning was enabled for your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business_secret_scanning_push_protection.enabled_for_new_repos", "description": "Push protection for secret scanning was enabled for new repositories in your enterprise.", - "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise" + "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.secret_scanning_repo_admin_settings_policy_update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_fork_pr_approvals_policy", "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_actions_settings", "description": "An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_default_repository_permission", "description": "The base repository permission setting was updated for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-base-repository-permissions", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_member_repository_creation_permission", "description": "The repository creation setting was updated for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-creation", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.update_member_repository_invitation_permission", "description": "The policy setting for enterprise members inviting outside collaborators to repositories was updated.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-inviting-outside-collaborators-to-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.destroy", "description": "Triggered when a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.destroy", "description": "Triggered when a reply to a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.update", "description": "Triggered when a reply to a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.update", "description": "Triggered when a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.create", "description": "A global announcement banner was created for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise#creating-a-global-announcement-banner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.destroy", "description": "A global announcement banner was removed from the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_announcement.update", "description": "A global announcement banner was updated for the enterprise.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise" + "docs_reference_links": "/admin/managing-accounts-and-repositories/communicating-information-to-users-in-your-enterprise/customizing-user-messages-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.approve", "description": "A domain was approved for an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#approving-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.create", "description": "A domain was added to an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.destroy", "description": "A domain was removed from an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_domain.verify", "description": "A domain was verified for an enterprise.", - "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account" + "docs_reference_links": "/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise#verifying-a-domain-for-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.register_self_hosted_runner", "description": "A new GitHub Actions self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.remove_self_hosted_runner", "description": "A GitHub Actions self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_created", "description": "A GitHub Actions self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_removed", "description": "A GitHub Actions self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runner_removed", "description": "The REST API was used to remove a GitHub Actions self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runners_added", "description": "A GitHub Actions self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_runners_updated", "description": "A GitHub Actions runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.runner_group_updated", "description": "The configuration of a GitHub Actions self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_offline", "description": "The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_online", "description": "The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise.self_hosted_runner_updated", "description": "The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git.clone", "description": "A repository was cloned.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.fetch", "description": "Changes were fetched from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.push", "description": "Changes were pushed to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git_signing_ssh_public_key.create", "description": "An SSH key was added to a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.delete", "description": "An SSH key was removed from a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable", "description": "An IP allow list was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_for_installed_apps", "description": "An IP allow list was disabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_user_level_enforcement", "description": "IP allow list user level enforcement was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable", "description": "An IP allow list was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_for_installed_apps", "description": "An IP allow list was enabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_user_level_enforcement", "description": "IP allow list user level enforcement was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.create", "description": "An IP address was added to an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.destroy", "description": "An IP address was deleted from an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.update", "description": "An IP address or its description was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.publish", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.retire", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.suspend", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.unsuspend", "description": "An OAuth application was unsuspended for a user or organization account.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.create", "description": "An authorization for an OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.destroy", "description": "An authorization for an OAuth application was deleted.", - "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations" + "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.update", "description": "An authorization for an OAuth application was updated.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.accept_business_invitation", "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_billing_manager", "description": "A billing manager was added to an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_disabled", "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_enabled", "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.async_delete", "description": "A user initiated a background job to delete an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.audit_log_export", "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.billing_signup_error", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.block_user", "description": "An organization owner blocked a user from accessing the organization's repositories.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_business_invitation", "description": "An invitation for an organization to join an enterprise was revoked", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_invitation", "description": "An invitation sent to a user to join an organization was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.clear_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_enabled", "description": "Code scanning using the default setup was enabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.confirm_business_invitation", "description": "An invitation for an organization to join an enterprise was confirmed.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create", "description": "An organization was created.", - "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" + "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.delete", "description": "An organization was deleted by a user-initiated background job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_member_team_creation_permission", "description": "Team creation was limited to owners.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_reader_discussion_creation_permission", "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_saml", "description": "SAML single sign-on was disabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_two_factor_requirement", "description": "A two-factor authentication requirement was disabled for the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_disabled", "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_enabled", "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_member_team_creation_permission", "description": "Team creation by members was allowed.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_reader_discussion_creation_permission", "description": "An organization owner allowed users with read access to create discussions in an organization", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_saml", "description": "SAML single sign-on was enabled for the organization.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_two_factor_requirement", "description": "Two-factor authentication is now required for the organization.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_added", "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_removed", "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_member", "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_to_business", "description": "An organization was invited to join an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rate_limited_invites", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.recreate", "description": "An organization was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_billing_manager", "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_outside_collaborator", "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rename", "description": "An organization was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.restore_member", "description": "An organization member was restored.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_created", "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_removed", "description": "A self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runner_removed", "description": "The REST API was used to remove a self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_added", "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_updated", "description": "A runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_updated", "description": "The configuration of a self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_disabled", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_enabled", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_updated", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_disable", "description": "Push protection for secret scanning was disabled.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_enable", "description": "Push protection for secret scanning was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_disable", "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_enable", "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transform", "description": "A user account was converted into an organization.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-personal-account/converting-a-user-into-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.unblock_user", "description": "A user was unblocked from an organization.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_settings", "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_default_repository_permission", "description": "The default repository permission level for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_saml_provider_settings", "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_terms_of_service", "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", - "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" + "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.approve", "description": "A domain was approved for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.create", "description": "A domain was added to an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.destroy", "description": "A domain was removed from an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.verify", "description": "A domain was verified for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_deleted", "description": "An entire package was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_published", "description": "A package was published or republished to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_deleted", "description": "A specific package version was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_published", "description": "A specific package version was published or republished to a package.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.register", "description": "A new passkey was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.remove", "description": "A new passkey was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.create", "description": "Triggered when you create a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_regenerated", "description": "Triggered when you regenerate a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_revoked", "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", - "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users" + "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.destroy", "description": "Triggered when you delete a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.update", "description": "A fine-grained personal access token was updated.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.authorized_users_teams", "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.create", "description": "Branch protection was enabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.destroy", "description": "Branch protection was disabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismiss_stale_reviews", "description": "Enforcement of dismissing stale pull requests was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismissal_restricted_users_teams", "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.policy_override", "description": "A branch protection requirement was overridden by a repository administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "after", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "before", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "compliant_pull_request_ids", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "overridden_codes", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reasons", + "referrer", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.rejected_ref_update", "description": "A branch update attempt was rejected.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_admin_enforced", "description": "Branch protection was enforced for repository administrators.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_deletions_enforcement_level", "description": "Branch deletion was enabled or disabled for a protected branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_force_pushes_enforcement_level", "description": "Force pushes were enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_ignore_approvals_from_contributors", "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_linear_history_requirement_enforcement_level", "description": "Required linear commit history was enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_allows_fetch_and_merge", "description": "Fork syncing was enabled or disabled for a read-only branch", - "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_branch_enforcement_level", "description": "The enforcement of a branch lock was updated.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_name", "description": "A branch name pattern was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_pull_request_reviews_enforcement_level", "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_code_owner_review", "description": "Enforcement of required code owner review was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_last_push_approval", "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_approving_review_count", "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_status_checks_enforcement_level", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_signature_requirement_enforcement_level", "description": "Enforcement of required commit signing was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_strict_required_status_checks_policy", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.close", "description": "A pull request was closed without being merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.converted_to_draft", "description": "A pull request was converted to a draft.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create", "description": "A pull request was created.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create_review_request", "description": "A review was requested on a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.in_progress", "description": "A pull request was marked as in progress.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.indirect_merge", "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.merge", "description": "A pull request was merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.ready_for_review", "description": "A pull request was marked as ready for review.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.rebase", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.remove_review_request", "description": "A review request was removed from a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.reopen", "description": "A pull request was reopened after previously being closed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.create", "description": "A review comment was added to a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.delete", "description": "A review comment on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.update", "description": "A review comment on a pull request was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.delete", "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.dismiss", "description": "A review on a pull request was dismissed.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.submit", "description": "A review on a pull request was submitted.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_disabled", "description": "Code scanning using the default setup was disabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_enabled", "description": "Code scanning using the default setup was enabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.disk_archive", "description": "A repository was archived on disk.", - "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories" + "docs_reference_links": "/repositories/archiving-a-github-repository/archiving-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.download_zip", "description": "A source code archive of a repository was downloaded as a ZIP file.", - "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives" + "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.hide_from_discovery", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.noindex", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.override_unlock", "description": "The repository was unlocked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_build", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.require_login", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.disable", "description": "Secret scanning was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.enable", "description": "Secret scanning was enabled for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.disable", "description": "Secret scanning push protection was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.enable", "description": "Secret scanning push protection was enabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.disable", "description": "Email notification restrictions for an organization or enterprise were disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.enable", "description": "Email notification restrictions for an organization or enterprise were enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.create", "description": "GitHub detected a secret and created a secret scanning alert.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.reopen", "description": "A seret scanning alert was reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.resolve", "description": "A seret scanning alert was resolved.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.revoke", "description": "A secret scanning alert was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.disable", "description": "Secret scanning was disabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.enable", "description": "Secret scanning was enabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.disable", "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.enable", "description": "Secret scanning was enabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_push_protection.bypass", "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.register", "description": "A security key was registered for an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.remove", "description": "A security key was removed from an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_update_newsletter_send", "description": "Triggered when you send an email update to your sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.waitlist_join", "description": "You join the waitlist to join GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.create", "description": "An SSH certificate authority for an organization or enterprise was created.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.destroy", "description": "An SSH certificate authority for an organization or enterprise was deleted.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.disable", "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.enable", "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.set_domain_token_expiration", "description": "The verification code expiry time for an organization or enterprise domain was set.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.unverify_domain", "description": "An organization or enterprise domain was unverified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.verify_domain", "description": "An organization or enterprise domain was verified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.accept", "description": "Triggered when you accept a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.cancel", "description": "Triggered when you cancel a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.create", "description": "Triggered when you create a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.decline", "description": "Triggered when you decline a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.revoke", "description": "Triggered when you revoke a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_member", "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_repository", "description": "A team was given access and permissions to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_parent_team", "description": "A child team was created or a child team's parent was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" + "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_privacy", "description": "A team's privacy level was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility" + "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.create", "description": "A new team is created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.demote_maintainer", "description": "A user was demoted from a team maintainer to a team member.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.destroy", "description": "A team was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.clear", "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.disable", "description": "Team discussions were disabled for an organization.", - "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization" + "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.enable", "description": "Team discussions were enabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.promote_maintainer", "description": "A user was promoted from a team member to a team maintainer.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_member", "description": "An organization member was removed from a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.rename", "description": "A team's name was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.disabled", "description": "Team synchronization with a tenant was disabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.enabled", "description": "Team synchronization with a tenant was enabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.register", "description": "A new trusted device was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.remove", "description": "A trusted device was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.abort", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.complete", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.ignore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_approve", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_decline", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.start", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.two_factor_destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.add_factor", "description": "A secondary authentication factor was added to a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.disabled", "description": "Two-factor authentication was disabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.enabled", "description": "Two-factor authentication was enabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.password_reset_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.recovery_codes_regenerated", "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.remove_factor", "description": "A secondary authentication factor was removed from a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.sign_in_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.update_fallback", "description": "The two-factor authentication fallback for a user account was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.add_email", "description": "An email address was added to a user account.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.async_delete", "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.audit_log_export", "description": "Audit log entries were exported.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.block_user", "description": "A user was blocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.change_password", "description": "A user changed their password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_granted", "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_revoked", "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_device", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_device_and_location", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.correct_password_from_unrecognized_location", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create", "description": "A new user account was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create_integration_secret", "description": "A user secret for Codespaces was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.creation_rate_limit_exceeded", "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.delete", "description": "A user account was destroyed by an asynchronous job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.demote", "description": "A site administrator was demoted to an ordinary user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.destroy", "description": "A user deleted his or her account, triggering user.async_delete.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_failure", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_requested", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_success", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.failed_login", "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.flag_as_large_scale_contributor", "description": "A user account was flagged as a large scale contributor. Only contributions from public repositories the user owns will be shown in their contribution graph, in order to prevent timeouts.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.forgot_password", "description": "A user requested a password reset.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.grant_github_developer", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.hide_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.login", "description": "A user signed in.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.minimize_comment", "description": "A comment made by a user was minimized.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.new_device_used", "description": "A user signed in from a new device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.partial_two_factor_email_followup", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.promote", "description": "An ordinary user account was promoted to a site administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.recreate", "description": "A user's account was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_email", "description": "An email address was removed from a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_integration_secret", "description": "A user secret for Codespaces was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_large_scale_contributor_flag", "description": "A user account was no longer flagged as a large scale contributor.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.rename", "description": "A username was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.report_abuse", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.report_content", "description": "Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.reset_password", "description": "A user reset their account password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_session.country_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.show_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device", "description": "A user signed in from an unrecognized device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device_and_location", "description": "A user signed in from an unrecognized device and location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_location", "description": "A user signed in from an unrecognized location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.destroy", "description": "Triggered when you clear the status on your profile.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.update", "description": "Triggered when you set or change the status on your profile.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.suspend", "description": "A user account was suspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.toggle_warn_private_email", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_failure", "description": "A 2FA challenge issued for a user account failed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_success", "description": "A 2FA challenge issued for a user account succeeded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recover", "description": "A user used their 2FA recovery codes.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_downloaded", "description": "A user downloaded 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_printed", "description": "A user printed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_viewed", "description": "A user viewed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_requested", "description": "A user was prompted for a two-factor authentication code.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unblock_user", "description": "A user was unblocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unminimize_comment", "description": "A comment made by a user was unminimized.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unsuspend", "description": "A user account was unsuspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_integration_secret", "description": "A user secret for Codespaces was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_new_repository_default_branch_setting", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.cancel_workflow_run", "description": "A workflow run was cancelled.", - "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow" + "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.completed_workflow_run", "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history" + "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.created_workflow_run", "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow" + "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.prepared_workflow_job", "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows" + "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.rerun_workflow_run", "description": "A workflow run was re-run.", - "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs" + "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.9/organization.json b/src/audit-logs/data/ghes-3.9/organization.json index 187853ee55aa..861639f03d4f 100644 --- a/src/audit-logs/data/ghes-3.9/organization.json +++ b/src/audit-logs/data/ghes-3.9/organization.json @@ -2,2816 +2,95822 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.accept", "description": "Credit was accepted for a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.create", "description": "Someone was added to the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.decline", "description": "Credit was declined for a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "advisory_credit.destroy", "description": "Someone was removed from the credit section of a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "auto_approve_personal_access_token_requests.disable", "description": "Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "auto_approve_personal_access_token_requests.enable", "description": "Triggered when fine-grained personal access tokens can access organization resources without prior approval.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.attempted_to_create_from_prebuild", "description": "An attempt to create a codespace from a prebuild was made.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.business_enablement_updated", "description": "Enterprise setting for Codespaces ownership was updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/choosing-who-owns-and-pays-for-codespaces-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_created", "description": "Policies were applied to codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_deleted", "description": "Policies were removed from codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.policy_group_updated", "description": "Policies were updated for codespaces in an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "commit_comment.destroy", "description": "A commit comment was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "commit_comment.update", "description": "A commit comment was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_comment.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_comment.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.destroy", "description": "Triggered when a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.destroy", "description": "Triggered when a reply to a team discussion post is deleted.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#deleting-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post_reply.update", "description": "Triggered when a reply to a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "discussion_post.update", "description": "Triggered when a team discussion post is edited.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment" + "docs_reference_links": "/communities/moderating-comments-and-conversations/managing-disruptive-comments#editing-a-comment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_installation.create", "description": "The GitHub App associated with a GitHub Connect connection was created.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "enterprise_installation.destroy", "description": "The GitHub App associated with a GitHub Connect connection was deleted.", - "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect" + "docs_reference_links": "/admin/configuration/configuring-github-connect/managing-github-connect", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git.clone", "description": "A repository was cloned.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.fetch", "description": "Changes were fetched from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "git.push", "description": "Changes were pushed to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actor", + "actor_id", + "business", + "business_id", + "hashed_token", + "org", + "org_id", + "programmatic_access_type", + "repo", + "repo_id", + "repository", + "repository_public", + "token_id", + "token_scopes", + "transport_protocol", + "transport_protocol_name", + "user", + "user_agent", + "user_id" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation_request.close", "description": "A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reason", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "url", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation_request.create", "description": "A member requested that an owner install a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner" + "docs_reference_links": "/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "url", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable", "description": "An IP allow list was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.disable_for_installed_apps", "description": "An IP allow list was disabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable", "description": "An IP allow list was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list.enable_for_installed_apps", "description": "An IP allow list was enabled for installed GitHub Apps.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.create", "description": "An IP address was added to an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.destroy", "description": "An IP address was deleted from an IP allow list.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ip_allow_list_entry.update", "description": "An IP address or its description was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue_comment.destroy", "description": "A comment on an issue was deleted from the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue_comment.update", "description": "A comment on an issue (other than the initial one) changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.destroy", "description": "An issue was deleted from the repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue" + "docs_reference_links": "/issues/tracking-your-work-with-issues/deleting-an-issue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.pinned", "description": "An issue was pinned to a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.transfer", "description": "An issue was transferred to another repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issue.unpinned", "description": "An issue was unpinned from a repository.", - "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository" + "docs_reference_links": "/issues/tracking-your-work-with-issues/pinning-an-issue-to-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_disabled", "description": "The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_enabled", "description": "The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "issues.deletes_policy_cleared", "description": "An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-deleting-issues", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_pages.disable", "description": "The ability for members to publish GitHub Pages sites was disabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_pages.enable", "description": "The ability for members to publish GitHub Pages sites was enabled.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_private_pages.disable", "description": "The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_private_pages.enable", "description": "The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_public_pages.disable", "description": "The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_create_public_pages.enable", "description": "The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.clear", "description": "An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.disable", "description": "The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_delete_repos.enable", "description": "The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-repository-deletion-and-transfer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.clear", "description": "An enterprise owner cleared the policy setting for viewing dependency insights in any organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.disable", "description": "The ability for enterprise members to view dependency insights was disabled. Members cannot view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "members_can_view_dependency_insights.enable", "description": "The ability for enterprise members to view dependency insights was enabled. Members can view dependency insights in any organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-dependency-insights-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.destroy_file", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.download", "description": "A migration file for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance was downloaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.accept_business_invitation", "description": "An invitation sent to an organization to join an enterprise was accepted.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_billing_manager", "description": "A billing manager was added to an organization.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_disabled", "description": "An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_policy_selected_member_enabled", "description": "An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.allow_third_party_access_requests_from_outside_collaborators_disabled", "description": "Third-party application access for outside collaborators was disabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.allow_third_party_access_requests_from_outside_collaborators_enabled", "description": "Third-party application access for outside collaborators was enabled for the organization.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests#enabling-or-disabling-integration-access-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.archive", "description": "The organization was archived.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.audit_log_export", "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.audit_log_git_event_export", "description": "An export of the organization's Git events was created.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.billing_signup_error", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.block_user", "description": "An organization owner blocked a user from accessing the organization's repositories.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_business_invitation", "description": "An invitation for an organization to join an enterprise was revoked", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.cancel_invitation", "description": "An invitation sent to a user to join an organization was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.clear_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_disabled", "description": "Code scanning using the default setup was disabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codeql_enabled", "description": "Code scanning using the default setup was enabled for an organization.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to all other repositories in an organization.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to all other repositories in an organization was revoked.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_collaborators_only", "description": "The interaction limit for collaborators only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_contributors_only", "description": "The interaction limit for prior contributors only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users only for an organization was enabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-organization#limiting-interactions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.confirm_business_invitation", "description": "An invitation for an organization to join an enterprise was confirmed.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.connect_usage_metrics_export", "description": "Server statistics were exported for the organization.", - "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics" + "docs_reference_links": "/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create", "description": "An organization was created.", - "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch" + "docs_reference_links": "/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_actions_secret", "description": "A GitHub Actions secret was created for an organization.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.create_integration_secret", "description": "An integration secret was created for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.deauthorize", "description": "A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.grant", "description": "A member authorized credentials for use with SAML or OIDC single sign-on.", - "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on" + "docs_reference_links": "/authentication/authenticating-with-saml-single-sign-on", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_credential_authorization.revoke", "description": "An owner revoked authorized credentials.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_member_team_creation_permission", "description": "Team creation was limited to owners.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were disabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_reader_discussion_creation_permission", "description": "An organization owner limited discussion creation to users with at least triage permission in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_saml", "description": "SAML single sign-on was disabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the organization was disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.disable_two_factor_requirement", "description": "A two-factor authentication requirement was disabled for the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_disabled", "description": "An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.display_commenter_full_name_enabled", "description": "An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_member_team_creation_permission", "description": "Team creation by members was allowed.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/setting-team-creation-permissions-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_oauth_app_restrictions", "description": "Third-party application access restrictions for an organization were enabled.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/enabling-oauth-app-access-restrictions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_reader_discussion_creation_permission", "description": "An organization owner allowed users with read access to create discussions in an organization", - "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_saml", "description": "SAML single sign-on was enabled for the organization.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_source_ip_disclosure", "description": "Display of IP addresses within audit log events for the organization was enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.enable_two_factor_requirement", "description": "Two-factor authentication is now required for the organization.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_added", "description": "An organization owner granted a member access to manage all GitHub Apps owned by an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.integration_manager_removed", "description": "An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_member", "description": "A new user was invited to join an organization.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/inviting-users-to-join-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.invite_to_business", "description": "An organization was invited to join an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.disable", "description": "The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.members_can_update_protected_branches.enable", "description": "The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_approved", "description": "Access to an organization was granted for an OAuth App.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/approving-oauth-apps-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "url", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_denied", "description": "Access was disabled for an OAuth App that was previously approved.", - "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization" + "docs_reference_links": "/organizations/managing-oauth-access-to-your-organizations-data/denying-access-to-a-previously-approved-oauth-app-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "url", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.oauth_app_access_requested", "description": "An organization member requested that an owner grant an OAuth App access to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "url", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rate_limited_invites", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_actions_secret", "description": "A GitHub Actions secret was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_billing_manager", "description": "A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" + "docs_reference_links": "/organizations/managing-peoples-access-to-your-organization-with-roles/removing-a-billing-manager-from-your-organization, /organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_integration_secret", "description": "An integration secret was removed from an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_outside_collaborator", "description": "An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_security_manager", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.rename", "description": "An organization was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_create", "description": "Triggered when a required workflow is created.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_delete", "description": "Triggered when a required workflow is deleted.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.required_workflow_update", "description": "Triggered when a required workflow is updated.", - "docs_reference_links": "/actions/using-workflows/required-workflows" + "docs_reference_links": "/actions/using-workflows/required-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.restore_member", "description": "An organization member was restored.", - "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization" + "docs_reference_links": "/organizations/managing-membership-in-your-organization/reinstating-a-former-member-of-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.revoke_external_identity", "description": "A member's linked identity was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.revoke_sso_session", "description": "A member's SAML session was revoked.", - "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity" + "docs_reference_links": "/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_created", "description": "A self-hosted runner group was created.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_removed", "description": "A self-hosted runner group was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_renamed", "description": "A self-hosted runner group was renamed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runner_removed", "description": "The REST API was used to remove a self-hosted runner from a group.", - "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#remove-a-self-hosted-runner-from-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_added", "description": "A self-hosted runner was added to a group.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_runners_updated", "description": "A runner group's list of members was updated.", - "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization" + "docs_reference_links": "/rest/actions#set-self-hosted-runners-in-a-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_updated", "description": "The configuration of a self-hosted runner group was changed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.runner_group_visiblity_updated", "description": "The visibility of a self-hosted runner group was updated via the REST API.", - "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization" + "docs_reference_links": "/rest/actions#update-a-self-hosted-runner-group-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_custom_pattern_push_protection_enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_disabled", "description": "The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_enabled", "description": "The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_custom_message_updated", "description": "The custom message triggered by an attempted push to a push-protected repository was updated for an organization.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#enabling-secret-scanning-as-a-push-protection-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_disable", "description": "Push protection for secret scanning was disabled.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_enable", "description": "Push protection for secret scanning was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_disable", "description": "Push protection for secret scanning was disabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.secret_scanning_push_protection_new_repos_enable", "description": "Push protection for secret scanning was enabled for all new repositories in the organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_custom_invitation_rate_limit", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.sso_response", "description": "A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transfer", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.transfer_outgoing", "description": "An organization was transferred between enterprise accounts.", - "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts" + "docs_reference_links": "/admin/managing-accounts-and-repositories/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#transferring-an-organization-between-enterprise-accounts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.unblock_user", "description": "A user was unblocked from an organization.", - "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization" + "docs_reference_links": "/communities/maintaining-your-safety-on-github/unblocking-a-user-from-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_settings", "description": "An organization owner or site administrator updated GitHub Actions policy settings for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_default_repository_permission", "description": "The default repository permission level for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_integration_secret", "description": "An integration secret was updated for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_new_repository_default_branch_setting", "description": "The name of the default branch was changed for new repositories in the organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/managing-the-default-branch-name-for-repositories-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_saml_provider_settings", "description": "An organization's SAML provider settings were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_terms_of_service", "description": "An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.", - "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement" + "docs_reference_links": "/organizations/managing-organization-settings/upgrading-to-the-github-customer-agreement", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.create", "description": "A default label was created for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#creating-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.destroy", "description": "A default label was deleted for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_default_label.update", "description": "A default label was edited for repositories in an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label" + "docs_reference_links": "/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.approve", "description": "A domain was approved for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#approving-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.create", "description": "A domain was added to an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.destroy", "description": "A domain was removed from an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#removing-an-approved-or-verified-domain", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_domain.verify", "description": "A domain was verified for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization#verifying-a-domain-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.add_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.add_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.remove_team", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_moderators.remove_user", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.clear", "description": "An enterprise owner cleared the policy setting for organization-wide project boards in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.disable", "description": "Organization projects were disabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "organization_projects_change.enable", "description": "Organization projects were enabled for all organizations in an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_deleted", "description": "An entire package was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_published", "description": "A package was published or republished to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_deleted", "description": "A specific package version was deleted.", - "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package" + "docs_reference_links": "/packages/learn-github-packages/deleting-and-restoring-a-package", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "packages.package_version_published", "description": "A specific package version was published or republished to a package.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.create", "description": "A GitHub Codespaces prebuild configuration for a repository was created.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.destroy", "description": "A GitHub Codespaces prebuild configuration for a repository was deleted.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.run_triggered", "description": "A user initiated a run of a GitHub Codespaces prebuild configuration for a repository branch.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "prebuild_configuration.update", "description": "A GitHub Codespaces prebuild configuration for a repository was edited.", - "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds" + "docs_reference_links": "/codespaces/prebuilding-your-codespaces/about-github-codespaces-prebuilds", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.clear", "description": "An enterprise owner cleared the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.disable", "description": "An enterprise owner disabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are never allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_repository_forking.enable", "description": "An enterprise owner enabled the policy setting for allowing forks of private and internal repositories, for a repository, organization or enterprise. Private and internal repositories are always allowed to be forked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.authorized_users_teams", "description": "The users, teams, or integrations allowed to bypass a branch protection were changed.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.create", "description": "Branch protection was enabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.destroy", "description": "Branch protection was disabled on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismiss_stale_reviews", "description": "Enforcement of dismissing stale pull requests was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.dismissal_restricted_users_teams", "description": "Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.policy_override", "description": "A branch protection requirement was overridden by a repository administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "after", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "before", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "compliant_pull_request_ids", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "overridden_codes", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "reasons", + "referrer", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.rejected_ref_update", "description": "A branch update attempt was rejected.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_admin_enforced", "description": "Branch protection was enforced for repository administrators.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_deletions_enforcement_level", "description": "Branch deletion was enabled or disabled for a protected branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_allow_force_pushes_enforcement_level", "description": "Force pushes were enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_ignore_approvals_from_contributors", "description": "Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_linear_history_requirement_enforcement_level", "description": "Required linear commit history was enabled or disabled for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_allows_fetch_and_merge", "description": "Fork syncing was enabled or disabled for a read-only branch", - "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_lock_branch_enforcement_level", "description": "The enforcement of a branch lock was updated.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#lock-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_name", "description": "A branch name pattern was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_pull_request_reviews_enforcement_level", "description": "Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_code_owner_review", "description": "Enforcement of required code owner review was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_require_last_push_approval", "description": "Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_approving_review_count", "description": "Enforcement of the required number of approvals before merging was updated on a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_required_status_checks_enforcement_level", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_signature_requirement_enforcement_level", "description": "Enforcement of required commit signing was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_strict_required_status_checks_policy", "description": "Enforcement of required status checks was updated for a branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.close", "description": "A pull request was closed without being merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/closing-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.converted_to_draft", "description": "A pull request was converted to a draft.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#converting-a-pull-request-to-a-draft", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create", "description": "A pull request was created.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.create_review_request", "description": "A review was requested on a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.in_progress", "description": "A pull request was marked as in progress.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.indirect_merge", "description": "A pull request was considered merged because the pull request's commits were merged into the target branch.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.merge", "description": "A pull request was merged.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.ready_for_review", "description": "A pull request was marked as ready for review.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.rebase", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.remove_review_request", "description": "A review request was removed from a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request.reopen", "description": "A pull request was reopened after previously being closed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.create", "description": "A review comment was added to a pull request.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.delete", "description": "A review comment on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review_comment.update", "description": "A review comment on a pull request was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.delete", "description": "A review on a pull request was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.dismiss", "description": "A review on a pull request was dismissed.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pull_request_review.submit", "description": "A review on a pull request was submitted.", - "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review" + "docs_reference_links": "/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_disabled", "description": "Code scanning using the default setup was disabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codeql_enabled", "description": "Code scanning using the default setup was enabled for a repository.", - "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning" + "docs_reference_links": "/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codespaces_trusted_repo_access_granted", "description": "GitHub Codespaces was granted trusted repository access to this repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.codespaces_trusted_repo_access_revoked", "description": "GitHub Codespaces trusted repository access to this repository was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.download_zip", "description": "A source code archive of a repository was downloaded as a ZIP file.", - "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives" + "docs_reference_links": "/repositories/working-with-files/using-files/downloading-source-code-archives", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename_branch", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_offline", "description": "The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_online", "description": "The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.self_hosted_runner_updated", "description": "The runner application was updated. This event is not included in the JSON/CSV export.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#about-self-hosted-runners", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.close", "description": "Someone closed a security advisory.", - "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories" + "docs_reference_links": "/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.cve_request", "description": "Someone requested a CVE (Common Vulnerabilities and Exposures) number from GitHub for a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.github_broadcast", "description": "GitHub made a security advisory public in the GitHub Advisory Database.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.github_withdraw", "description": "GitHub withdrew a security advisory that was published in error.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.open", "description": "Someone opened a draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.publish", "description": "Someone published a security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.reopen", "description": "Someone reopened as draft security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_advisory.update", "description": "Someone edited a draft or published security advisory.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_content_analysis.disable", "description": "Data use settings were disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_content_analysis.enable", "description": "Data use settings were enabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_dependency_graph.disable", "description": "The dependency graph was disabled for a private repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-fea tures-for-your-repository/managing-security-and-analysis-settings-for-your-repository#enabling-or-disabling-security-and-analysis-features-for-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_dependency_graph.enable", "description": "The dependency graph was enabled for a private repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.clear", "description": "The repository projects policy was removed for an organization, or all organizations in the enterprise Organization owners can now control their repository projects settings.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-projects-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.disable", "description": "Repository projects were disabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_projects_change.enable", "description": "Repository projects were enabled for a repository, all repositories in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.create", "description": "A custom pattern was created for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.delete", "description": "A custom pattern was removed from secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.disabled", "description": "Push protection for a custom pattern for secret scanning was disabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern_push_protection.enabled", "description": "Push protection for a custom pattern for secret scanning was enabled for your repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#defining-a-custom-pattern-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_custom_pattern.update", "description": "Changes to a custom pattern were saved and a dry run was executed for secret scanning in a repository.", - "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern" + "docs_reference_links": "/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.disable", "description": "Secret scanning was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning.enable", "description": "Secret scanning was enabled for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.disable", "description": "Secret scanning push protection was disabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_secret_scanning_push_protection.enable", "description": "Secret scanning push protection was enabled for a repository.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.clear", "description": "The repository visibility change setting was cleared for an organization or enterprise.", - "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility" + "docs_reference_links": "/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise#enforcing-a-policy-for-changes-to-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.disable", "description": "The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_visibility_change.enable", "description": "The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.create", "description": "GitHub created a Dependabot alert because the repository uses a vulnerable dependency.", - "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts" + "docs_reference_links": "/code-security/dependabot/dependabot-alerts/about-dependabot-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.dismiss", "description": "A Dependabot alert was manually dismissed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.reintroduce", "description": "A Dependabot alert was automatically reopened because the repository resumed use of a vulnerable dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.reopen", "description": "A Dependabot alert was manually reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alert.resolve", "description": "Changes were pushed to update and resolve a Dependabot alert in a project dependency.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.authorized_users_teams", "description": "The list of people or teams authorized to receive Dependabot alerts for the repository was updated.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.disable", "description": "Dependabot alerts was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_vulnerability_alerts.enable", "description": "Dependabot alerts was enabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "required_status_check.create", "description": "A status check was marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "context", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "required_status_check.destroy", "description": "A status check was no longer marked as required for a protected branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "context", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.disable", "description": "Email notification restrictions for an organization or enterprise were disabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "restrict_notification_delivery.enable", "description": "Email notification restrictions for an organization or enterprise were enabled.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/restricting-email-notifications-for-your-organization, /admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.create", "description": "A new custom repository role was created.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.destroy", "description": "A custom repository role was deleted.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "role.update", "description": "A custom repository role was edited.", - "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization" + "docs_reference_links": "/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.create", "description": "GitHub detected a secret and created a secret scanning alert.", - "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.reopen", "description": "A seret scanning alert was reopened.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.resolve", "description": "A seret scanning alert was resolved.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_alert.revoke", "description": "A secret scanning alert was revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.disable", "description": "Secret scanning was disabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning.enable", "description": "Secret scanning was enabled for all existing repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.disable", "description": "Secret scanning was disabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_new_repos.enable", "description": "Secret scanning was enabled for all new repositories.", - "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning" + "docs_reference_links": "/code-security/secret-scanning/about-secret-scanning", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "secret_scanning_push_protection.bypass", "description": "Triggered when a user bypasses the push protection on a secret detected by secret scanning.", - "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret" + "docs_reference_links": "/code-security/secret-scanning/protecting-pushes-with-secret-scanning#bypassing-push-protection-for-a-secret", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.create", "description": "An SSH certificate authority for an organization or enterprise was created.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_authority.destroy", "description": "An SSH certificate authority for an organization or enterprise was deleted.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.disable", "description": "The requirement for members to use SSH certificates to access an organization resources was disabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "ssh_certificate_requirement.enable", "description": "The requirement for members to use SSH certificates to access an organization resources was enabled.", - "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise" + "docs_reference_links": "/organizations/managing-git-access-to-your-organizations-repositories/managing-your-organizations-ssh-certificate-authorities, /admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#managing-ssh-certificate-authorities-for-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.dependabot_debug_credentials_generated", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.set_domain_token_expiration", "description": "The verification code expiry time for an organization or enterprise domain was set.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.unverify_domain", "description": "An organization or enterprise domain was unverified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "staff.verify_domain", "description": "An organization or enterprise domain was verified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_member", "description": "A member of an organization was added to a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/adding-organization-members-to-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.add_repository", "description": "A team was given access and permissions to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_parent_team", "description": "A child team was created or a child team's parent was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy" + "docs_reference_links": "/organizations/organizing-members-into-teams/moving-a-team-in-your-organizations-hierarchy", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.change_privacy", "description": "A team's privacy level was changed.", - "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility" + "docs_reference_links": "/organizations/organizing-members-into-teams/changing-team-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.create", "description": "A new team is created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.demote_maintainer", "description": "A user was demoted from a team maintainer to a team member.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.destroy", "description": "A team was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.clear", "description": "An organization owner cleared the setting to allow team discussions for an organization or enterprise.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.disable", "description": "Team discussions were disabled for an organization.", - "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization" + "docs_reference_links": "/organizations/organizing-members-into-teams/disabling-team-discussions-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_discussions.enable", "description": "Team discussions were enabled for an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_group_mapping.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.promote_maintainer", "description": "A user was promoted from a team member to a team maintainer.", - "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer" + "docs_reference_links": "/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member#promoting-an-organization-member-to-team-maintainer", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_member", "description": "An organization member was removed from a team.", - "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team" + "docs_reference_links": "/organizations/organizing-members-into-teams/removing-organization-members-from-a-team", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.remove_repository", "description": "A repository was removed from a team's control.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.rename", "description": "A team's name was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.disabled", "description": "Team synchronization with a tenant was disabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.enabled", "description": "Team synchronization with a tenant was enabled.", - "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise" + "docs_reference_links": "/organizations/managing-saml-single-sign-on-for-your-organization/managing-team-synchronization-for-your-organization, /admin/identity-and-access-management/using-saml-for-enterprise-iam/managing-team-synchronization-for-organizations-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team_sync_tenant.update_okta_credentials", "description": "The Okta credentials for team synchronization with a tenant were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "team.update_repository_permission", "description": "A team's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.cancel_workflow_run", "description": "A workflow run was cancelled.", - "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow" + "docs_reference_links": "/actions/managing-workflow-runs/canceling-a-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.completed_workflow_run", "description": "A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history" + "docs_reference_links": "/actions/monitoring-and-troubleshooting-workflows/viewing-workflow-run-history", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.created_workflow_run", "description": "A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow" + "docs_reference_links": "/actions/learn-github-actions/understanding-github-actions#create-an-example-workflow", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.prepared_workflow_job", "description": "A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows" + "docs_reference_links": "/actions/using-workflows/events-that-trigger-workflows", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.rerun_workflow_run", "description": "A workflow run was re-run.", - "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs" + "docs_reference_links": "/actions/managing-workflow-runs/re-running-workflows-and-jobs", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/data/ghes-3.9/user.json b/src/audit-logs/data/ghes-3.9/user.json index deacc2bfae59..b24d21307722 100644 --- a/src/audit-logs/data/ghes-3.9/user.json +++ b/src/audit-logs/data/ghes-3.9/user.json @@ -2,1736 +2,59324 @@ { "action": "account.billing_date_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account.plan_change", "description": "The account's plan changed.", - "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans" + "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.confirm", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "account_recovery_token.recover", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method" + "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.change_email", "description": "The billing email address changed.", - "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email" + "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.lock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "billing.update_bill_cycle_day", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_fork_pr_approvals_policy", "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "business.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", - "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", - "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites" + "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.create", "description": "A codespace was created", - "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository" + "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", - "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace" + "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "custom_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", - "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" + "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.delete", "description": "An environment was deleted.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", - "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules" + "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.create", "description": "An SSH key was added to a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "git_signing_ssh_public_key.delete", "description": "An SSH key was removed from a user account as a Git commit signing key.", - "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" + "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "github_hosted_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "gpg_key.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.create", "description": "A new hook was added.", - "docs_reference_links": "/get-started/exploring-integrations/about-webhooks" + "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.destroy", "description": "A hook was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.create", "description": "A GitHub App was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.generate_client_secret", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", - "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps" + "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", - "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" + "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", - "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" + "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", - "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" + "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.publish", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.retire", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing_plan.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_dequeued", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.queue_cleared", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "merge_queue.update_settings", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "metered_billing_configuration.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", - "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" + "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.create", "description": "An authorization for an OAuth application was created.", - "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" + "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "oauth_authorization.destroy", "description": "An authorization for an OAuth application was deleted.", - "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations" + "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_member", "description": "A user joined an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", - "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", - "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators" + "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", - "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" + "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.register", "description": "A new passkey was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "passkey.remove", "description": "A new passkey was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "nickname", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.create", "description": "Triggered when you create a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_regenerated", "description": "Triggered when you regenerate a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.credential_revoked", "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", - "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users" + "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.destroy", "description": "Triggered when you delete a fine-grained personal access token.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", - "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" + "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "personal_access_token.update", "description": "A fine-grained personal access token was updated.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.create", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "premium_runner.update", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.access", "description": "A project board visibility was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.close", "description": "A project board was closed.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.create", "description": "A project board was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.delete", "description": "A project board was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.create", "description": "A field was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.link", "description": "A repository was linked to a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.open", "description": "A project board was reopened.", - "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board" + "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.rename", "description": "A project board was renamed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.create", "description": "A view was created in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", - "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" + "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", - "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" + "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", - "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" + "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.access", "description": "The visibility of a repository changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", - "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" + "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.archived", "description": "A repository was archived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", - "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" + "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", - "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch" + "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", - "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" + "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create", "description": "A repository was created.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", - "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository" + "docs_reference_links": "/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.create_integration_secret", "description": "An integration secret was created for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.destroy", "description": "A repository was deleted.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_integration_secret", "description": "An integration secret was deleted for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", - "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository" + "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.rename", "description": "A repository was renamed.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.restore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", - "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository" + "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", - "docs_reference_links": "/repositories/archiving-a-github-repository" + "docs_reference_links": "/repositories/archiving-a-github-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.unlock", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_actions_variable", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_integration_secret", "description": "An integration secret was updated for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee", + "invitee_email", + "inviter", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.register", "description": "A security key was registered for an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "security_key.remove", "description": "A security key was removed from an account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", - "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" + "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", - "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" + "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", - "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship" + "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.sponsored_developer_update_newsletter_send", "description": "Triggered when you send an email update to your sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.waitlist_join", "description": "You join the waitlist to join GitHub Sponsors.", - "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" + "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.accept", "description": "Triggered when you accept a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.cancel", "description": "Triggered when you cancel a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.create", "description": "Triggered when you create a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.decline", "description": "Triggered when you decline a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "successor_invitation.revoke", "description": "Triggered when you revoke a succession invitation.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.register", "description": "A new trusted device was added.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "trusted_device.remove", "description": "A trusted device was removed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.abort", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.complete", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.ignore", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_approve", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.staff_decline", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.start", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_account_recovery.two_factor_destroy", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.add_factor", "description": "A secondary authentication factor was added to a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.disabled", "description": "Two-factor authentication was disabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.enabled", "description": "Two-factor authentication was enabled for a user account.", - "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.password_reset_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.recovery_codes_regenerated", "description": "Two factor recovery codes were regenerated for a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.remove_factor", "description": "A secondary authentication factor was removed from a user account.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.sign_in_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "two_factor_authentication.update_fallback", "description": "The two-factor authentication fallback for a user account was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.add_email", "description": "An email address was added to a user account.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.async_delete", "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.audit_log_export", "description": "Audit log entries were exported.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.block_user", "description": "A user was blocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.change_password", "description": "A user changed their password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_granted", "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.codespaces_trusted_repo_access_revoked", "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", - "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces" + "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create", "description": "A new user account was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.create_integration_secret", "description": "A user secret for Codespaces was created.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.creation_rate_limit_exceeded", "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.delete", "description": "A user account was destroyed by an asynchronous job.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.demote", "description": "A site administrator was demoted to an ordinary user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.destroy", "description": "A user deleted his or her account, triggering user.async_delete.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_failure", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_requested", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.device_verification_success", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.disable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_collaborators_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_contributors_only", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.enable_sockpuppet_disallowed", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.failed_login", "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.forgot_password", "description": "A user requested a password reset.", - "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" + "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.grant_github_developer", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.hide_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.login", "description": "A user signed in.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.new_device_used", "description": "A user signed in from a new device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.promote", "description": "An ordinary user account was promoted to a site administrator.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.recreate", "description": "A user's account was restored.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_email", "description": "An email address was removed from a user account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.remove_integration_secret", "description": "A user secret for Codespaces was deleted.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.rename", "description": "A username was changed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_login", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.reset_password", "description": "A user reset their account password.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_session.country_change", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.show_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device", "description": "A user signed in from an unrecognized device.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.sign_in_from_unrecognized_device_and_location", "description": "A user signed in from an unrecognized device and location.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.destroy", "description": "Triggered when you clear the status on your profile.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user_status.update", "description": "Triggered when you set or change the status on your profile.", - "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status" + "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.suspend", "description": "A user account was suspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.toggle_warn_private_email", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_failure", "description": "A 2FA challenge issued for a user account failed.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_challenge_success", "description": "A 2FA challenge issued for a user account succeeded.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recover", "description": "A user used their 2FA recovery codes.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_downloaded", "description": "A user downloaded 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_printed", "description": "A user printed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_recovery_codes_viewed", "description": "A user viewed 2FA recovery codes for their account.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.two_factor_requested", "description": "A user was prompted for a two-factor authentication code.", - "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" + "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unblock_user", "description": "A user was unblocked by another user.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.unsuspend", "description": "A user account was unsuspended.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_integration_secret", "description": "A user secret for Codespaces was updated.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "user.update_new_repository_default_branch_setting", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.bypass_protection_rules", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", - "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run" + "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", - "docs_reference_links": "N/A" + "docs_reference_links": "N/A", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", - "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments" + "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", + "fields": [ + "@timestamp", + "_document_id", + "action", + "actions_cache_id", + "actions_cache_key", + "actions_cache_scope", + "actions_cache_version", + "active", + "active_was", + "actor", + "actor_id", + "admin_enforced", + "alert_number", + "allow_deletions_enforcement_level", + "allow_force_pushes_enforcement_level", + "application_name", + "authorized_actor_names", + "base_role", + "blocked_user", + "branch", + "business", + "business_id", + "calling_workflow_refs", + "calling_workflow_shas", + "cancelled_at", + "category", + "check_run_id", + "completed_at", + "conclusion", + "config", + "config_was", + "content_type", + "create_protected", + "created_at", + "credential_regenerated", + "credential_revoked", + "custom_pattern", + "deploy_key_fingerprint", + "dismiss_comment", + "dismiss_reason", + "dismiss_stale_reviews_on_push", + "emoji", + "enablement", + "enforcement_level", + "environment_name", + "event", + "events", + "events_were", + "explanation", + "fingerprint", + "from_business", + "ghsa_id", + "hashed_token", + "head_branch", + "head_sha", + "hook_id", + "ignore_approvals_from_contributors", + "imposer_repo", + "imposer_workflow_sha", + "integration", + "invitee_email", + "ip_allow_list_entry", + "is_hosted_runner", + "issuer", + "job_name", + "job_workflow_ref", + "key", + "limited_availability", + "linear_history_requirement_enforcement_level", + "lock_allows_fetch_and_merge", + "lock_branch_enforcement_level", + "manager", + "merge_queue_enforcement_level", + "message", + "name", + "new_repo_base_role", + "new_repo_permission", + "number", + "oauth_application", + "oauth_application_id", + "old_base_role", + "old_message", + "old_name", + "old_permission", + "old_permissions", + "old_repo_base_role", + "old_repo_permission", + "old_role_permissions", + "old_user", + "openssh_public_key", + "operation_type", + "org", + "org_id", + "organization_names", + "organization_upgrade", + "origin_repository", + "owner", + "owner_type", + "permission", + "previous_visibility", + "programmatic_access_type", + "public_repo", + "pull_request_id", + "pull_request_reviews_enforcement_level", + "pull_request_title", + "pull_request_url", + "read_only", + "repo", + "repo_id", + "repositories_added", + "repositories_added_names", + "repositories_removed", + "repositories_removed_names", + "repository_selection", + "request_cancelled", + "requested_permissions", + "require_code_owner_review", + "require_code_owner_review", + "require_last_push_approval", + "required_approving_review_count", + "required_approving_review_count", + "required_deployments_enforcement_level", + "required_review_thread_resolution_enforcement_level", + "required_status_checks_enforcement_level", + "rerun_type", + "resolution", + "revoked_permissions", + "role_permissions", + "run_attempt", + "run_number", + "runner_group_allow_public", + "runner_group_id", + "runner_group_name", + "runner_group_restricted_to_workflows", + "runner_group_selected_workflow_refs", + "runner_id", + "runner_labels", + "runner_name", + "runner_owner_type", + "secrets_passed", + "set_default_workflow_permissions", + "set_workflow_permission_can_approve_pr", + "signature_requirement_enforcement_level", + "source_version", + "sso_url", + "started_at", + "strict_required_status_checks_policy", + "target_login", + "target_version", + "team", + "title", + "to_business", + "token_id", + "token_scopes", + "tool", + "topic", + "trigger_id", + "user", + "user", + "user_agent", + "user_id", + "visibility", + "workflow_id", + "workflow_run_id" + ] } ] \ No newline at end of file diff --git a/src/audit-logs/lib/config.json b/src/audit-logs/lib/config.json index cac71f7f5a86..05280811ccc6 100644 --- a/src/audit-logs/lib/config.json +++ b/src/audit-logs/lib/config.json @@ -1,4 +1,4 @@ { "apiOnlyEventsAdditionalDescription": "This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.", - "sha": "958a43bea9460b86ba03ee6e2e5bb066cdbc7198" + "sha": "cf650ee638f2cb7c7428e17c89aabeee1e3c638f" } \ No newline at end of file